Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 07:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
-
Size
431KB
-
MD5
9d0470ba47f6d3f61072317f6904d434
-
SHA1
aac8a0e4bbb48c34e02587f68c7e447d40d8052f
-
SHA256
8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca
-
SHA512
091cb8c16805d2c47960baa1c3a8ac599cdec7333b0022f139a101ca6edde96ceafef8e85155d17eb9c13fd632998a58c055f576f342d701432fe95bd5cb9617
-
SSDEEP
6144:A3MbvBaO9o7nduQyxg3XdECeSf3pAvTd5GPtRQrY1STCJxLhsLpoq5ynENQpjBei:OMbz9obd8uXxGLd3rYo2Jdhs/qVpjBei
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\dotnet.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD91C.tmp 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\MavInject32.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\createdump.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\sIRC4.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MavInject32.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD97C.tmp 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\mip.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXD93C.tmp 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe 8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD56254099ef9ad7f739f50d65903937255
SHA1b13870e37d62a929ea8ce0c6213476f2a57fa3c0
SHA256cdd2cfe0f5bf927556acc79333f9423c1690d0e50656aea0457ceaf4b2b17a1f
SHA512f36b68d03e4b539490455a4f43e6dfd74a82e2ab247027f7ca2bb467221ea57d476f5fb6f26dab27a749359a537a09a42f8569386442d308f8a34632422733f4
-
Filesize
543KB
MD533818a220006692dbbf2292eba7ee904
SHA1b83f44ea5a70a3a0fdced7981f47e3ff041f3f6e
SHA2567e08a3b5a3fd09dac1db215e3b02ea820c833e04c1ff0958c1cc63a730934fa8
SHA512947735788d5cbfd54913e878374cefe639bfe5b8e1a329e83f9d61729bf1ab1e14bc31bb4db22f406fc171b3319d64b205eb6cb840ba1f71fe6aeef03660522c