Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 22:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1eea42857399620eb147f8667189eaa0N.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
120 seconds
Behavioral task
behavioral2
Sample
1eea42857399620eb147f8667189eaa0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
1eea42857399620eb147f8667189eaa0N.exe
-
Size
4.1MB
-
MD5
1eea42857399620eb147f8667189eaa0
-
SHA1
99b3c1d4187abaeb260a12c4151c88e026752b69
-
SHA256
241108c35caad66bb9dd4a740d53c5a3b71fc92685da9f44ad5c5ea30b0e3a7c
-
SHA512
b4f9eb11e5f2fb5837f8ddca9242e1d4ca53d707b09f92c03a783cfcf87eb959509d81756a60507daed4d86660b8ac4420b5a33c88e7b76b40729f1701a794f4
-
SSDEEP
98304:dUQU56nSmwa0twe1tiaFZ2piWl3AAKUyEVLIln7V/+:HUwS5Yu9/2puUyEVLYn7V/+
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" 1eea42857399620eb147f8667189eaa0N.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sIRC4.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\sIRC4.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javap.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBBD7.tmp 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBBB6.tmp 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBB94.tmp 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBB74.tmp 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBBD6.tmp 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\mip.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBB53.tmp 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe 1eea42857399620eb147f8667189eaa0N.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCXBB95.tmp 1eea42857399620eb147f8667189eaa0N.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe 1eea42857399620eb147f8667189eaa0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD51eea42857399620eb147f8667189eaa0
SHA199b3c1d4187abaeb260a12c4151c88e026752b69
SHA256241108c35caad66bb9dd4a740d53c5a3b71fc92685da9f44ad5c5ea30b0e3a7c
SHA512b4f9eb11e5f2fb5837f8ddca9242e1d4ca53d707b09f92c03a783cfcf87eb959509d81756a60507daed4d86660b8ac4420b5a33c88e7b76b40729f1701a794f4