Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe
-
Size
4.2MB
-
MD5
36e37f10405484f08a31af912ecdffc6
-
SHA1
d360437622641185fa29f1a59c3a5c49e6afdfdf
-
SHA256
84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca
-
SHA512
b80a8704ceeecdef76cc6d96e28f8049ba5e121ce73cc51b59d867c1fcd5f31e3a9103031092b73a6d0acece9def3b60f62b2dd908fa6ec0d7ca8db4b8f34396
-
SSDEEP
49152:SHJFPTI9DkYOMwwnMb4PmyV9HbYcMRT/HMph7GBfWxph7GBfWGLninAHC3M:CdYOXwnS4rVR5v77GBfWx77GBfWGLe8
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\7-Zip\7z.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3124 84ca0a6017d60d80186f83b3b984e495897d5ec58962dbed5a5d4a21a73832ca.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD509e6767b67f36ddbfc35f953fc3f20c0
SHA171053bcf50aa901aeb9b6f806cfbce891129b4d5
SHA256bd2d27a768f7d1dc21c3c161ee6aeb08ae43cb4a6c21e43159299b3524ae8c82
SHA512d6024e1c3b5d910bcaae622e8aaea719a3d5a5aac7259fee946ab559a1cd96502b78cd12b637280e17129ee898d50ca1eeffe92d07e8ab126cd82f0d9673e2c1