Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
Analysis
-
max time kernel
1179s -
max time network
1180s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/04/2024, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
inf.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
inf.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
inf.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
inf.exe
Resource
win11-20240412-en
General
-
Target
inf.exe
-
Size
1.3MB
-
MD5
73dea1a75637e14f6fcd012fe2815636
-
SHA1
f1edca0d6464b76bc4956352571d8941c02d2c4e
-
SHA256
fd03dd58aa7cb5236f4df8cde3fb07af304c6f402cd48b86eefcecb8e7b86883
-
SHA512
f6dc462194037a5c4e0b186088f1fd75befe4cb88bf1dcc7477987951332fc18f8aa66389d567e01677990b022fea6849a66a24510027794e12e2a517edde8d0
-
SSDEEP
24576:SkMiDApH5iholXZFFqn14hhzk8wncu0Z9Ml+5PkjyDs5U2cuC:tApsolXTF8mhC1c9WCkjMs5Uq
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2876-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-6-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-10-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-13-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-47-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-48-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-49-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-50-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-52-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-51-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-54-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-53-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-59-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-61-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-60-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-66-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-67-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-58-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-56-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-68-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-70-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-69-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-71-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-72-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-73-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-74-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-75-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-78-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-79-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-80-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-82-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-87-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-88-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-86-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-85-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-91-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-90-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-92-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-89-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-84-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-83-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-81-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2876-77-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" inf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" inf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: inf.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\94081D5594081D55.bmp" inf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js inf.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html inf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png inf.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png inf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css inf.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png inf.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html inf.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_left.png inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html inf.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini inf.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi inf.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml inf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png inf.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv inf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png inf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2380 vssadmin.exe 1948 vssadmin.exe 2100 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2876 inf.exe 2876 inf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 980 vssvc.exe Token: SeRestorePrivilege 980 vssvc.exe Token: SeAuditPrivilege 980 vssvc.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2876 inf.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2380 2876 inf.exe 30 PID 2876 wrote to memory of 2380 2876 inf.exe 30 PID 2876 wrote to memory of 2380 2876 inf.exe 30 PID 2876 wrote to memory of 2380 2876 inf.exe 30 PID 2876 wrote to memory of 1948 2876 inf.exe 34 PID 2876 wrote to memory of 1948 2876 inf.exe 34 PID 2876 wrote to memory of 1948 2876 inf.exe 34 PID 2876 wrote to memory of 1948 2876 inf.exe 34 PID 2876 wrote to memory of 2100 2876 inf.exe 36 PID 2876 wrote to memory of 2100 2876 inf.exe 36 PID 2876 wrote to memory of 2100 2876 inf.exe 36 PID 2876 wrote to memory of 2100 2876 inf.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\inf.exe"C:\Users\Admin\AppData\Local\Temp\inf.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:2380
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1948
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
PID:2100
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD52b3290d5ac543dee0bfc1091721f35bb
SHA1a54a1be74e046414fae4d5a14fe3ca58ddec5f67
SHA2566ff6fc6199a9971605a7d3cec30340166fcbd3573ec39a2014d80e91eb09af07
SHA512e0e66843055474ec2abf4a80f008650c1b986bfa150a28c045360f6f2fc723984cae24553c2311512e1bbbd39029e9aea65f1f3fd6870c14da0182c7c2466816