Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 22:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1234789dc119daef7ee5e9da8012ff70.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1234789dc119daef7ee5e9da8012ff70.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1234789dc119daef7ee5e9da8012ff70.exe
-
Size
62KB
-
MD5
1234789dc119daef7ee5e9da8012ff70
-
SHA1
1bdf026a6dfa1cb50cb1a782c767b816b9b4a8ec
-
SHA256
a433647ac84c583fce6d0a2f7164996801a9d42c271de0d9a71e5a6b0e8851f6
-
SHA512
88029d17f2c71e28922136d16c1499ec7f14decd5c41b5cebbddf87d23e74ecd50ee592e82bc70711eaa629728d67f0fc375d8df97150dbf9a21870ac3deea9c
-
SSDEEP
768:zfuSjFkS+Y1HD1mQwh5I6O5yXX2+57cySpzyRuqL77DG++SO4uPVGyMSaCbJmg0g:VxnhvmXm+tSpzy42b+S5uPYyMSaMo31y
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 1234789dc119daef7ee5e9da8012ff70.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\createdump.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\mip.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\mip.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\sIRC4.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\dotnet.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 1234789dc119daef7ee5e9da8012ff70.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 1234789dc119daef7ee5e9da8012ff70.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 1234789dc119daef7ee5e9da8012ff70.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD523bfd2f052bc1e70cf511bfc5e9dcb0f
SHA1e309c4a6b46d9263e9f6eebb3bd1484ba36c77de
SHA2568b497c575dbf8551717135742336c634a3c5112c55be17fe2039abf2655909fb
SHA512f46262d524a252114e6baeb4ec302050e13b1ba28538916f70065ae61298b312fab51e9eae806fcea4dbd8a6f17296ec1a4debadf20c4f5d172784a3c7ce0dbf