Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
Resource
win10v2004-20240226-en
General
-
Target
eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe
-
Size
26KB
-
MD5
3f2d3014196588ffc6fc985863a505d5
-
SHA1
cd523f7c44dc62e45c5df5c60f732b1c4ecb661e
-
SHA256
eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2
-
SHA512
c22ec9c25a5ff334d53a725981466df13b82afd6a6d02b2eb3e84a07672ee5ccd461e2f8df8f3751fef7c8fcd0adb39b62f76b0f4730e0c143a3fcb0e5235887
-
SSDEEP
768:yo1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoZw:ZfgLdQAQfcfymN
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\Q: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\P: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\M: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\I: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\Y: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\W: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\S: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\K: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\R: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\O: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\N: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\L: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\Z: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\X: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\V: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\T: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\H: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\U: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\J: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened (read-only) \??\G: eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Solitaire\es-ES\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Windows Mail\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Windows Defender\es-ES\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jre7\lib\cmm\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\DVD Maker\en-US\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Windows Sidebar\de-DE\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1252 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 28 PID 1132 wrote to memory of 1252 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 28 PID 1132 wrote to memory of 1252 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 28 PID 1132 wrote to memory of 1252 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 28 PID 1252 wrote to memory of 2716 1252 net.exe 30 PID 1252 wrote to memory of 2716 1252 net.exe 30 PID 1252 wrote to memory of 2716 1252 net.exe 30 PID 1252 wrote to memory of 2716 1252 net.exe 30 PID 1132 wrote to memory of 1208 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 21 PID 1132 wrote to memory of 1208 1132 eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe"C:\Users\Admin\AppData\Local\Temp\eb1455ac4f56a967b88b511299b4e4b427b10357679358571f24d49fb1e01fd2.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2716
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD568deb4d631c6a05b27aa65c94161278e
SHA12a44c22aba6a43c80f634683e32cdbf74d052b06
SHA256980448f135cd9735d7e80480222331c6b0f6cbf7482f4ad7dd29f314fbb3f60d
SHA512c8e7f3b83eac9e8052652d78e262fe1376597a2d582bd43e3553432592e65458d72ff8e50dd6795971c2d0dbd5fd6d6575d266accf360b87f3945cb3a062f4c4
-
Filesize
956KB
MD5e233a156a52ae968f1c9242a8526d268
SHA16a9ea8c88dcbb95ab7d7ab38bda5da9eb843f9fc
SHA2563d658b9684dca17c6756ae122295c6b5ef6f92bb405aa37c53511208ef2cf691
SHA5125494b029903dbcd809f67f0259457973e3f1cb95c1f21ea86713e08c46099aa4cdeffddb67f8003cb8fde151b39b7dd281071d1e0f313a178310edefa8fd6a85
-
Filesize
471KB
MD599ea9b604a7a734d3087fa6159684c42
SHA1709fa1068ad4d560fe03e05b68056f1b0bedbfc8
SHA2563f733f9e6fec7c4165ca8ba41eb23f604a248babe794c4ad2c6c3ce8032aab1c
SHA5127af8008c7e187f925c62efc97e1891a7a38d089302dba39fbde137fb895e0592847ed0982c824c2075be8e6b95b6ce165ecb848ab85adf53779ebef613410fbb
-
Filesize
9B
MD57ef570b2b21e58fd906ef1a980d64425
SHA118502489f652e74f8972bbfa100d5c163d719ab7
SHA256c3ce1b9216b58ac7d9ed3b93e5e3a1d6a2473b53b5bc1f008a621def49517055
SHA512e1175d861a79d62b85cd18661375f1c956dcc97e958765dc225f3aa4b0f0100ca9e17b9c61f5e18fc2a96e5167c0563f60645033aff1be1ec2f372c1b9a8b35f