Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4f101f59ab8b3923b7266915ac52cb0N.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
120 seconds
General
-
Target
e4f101f59ab8b3923b7266915ac52cb0N.exe
-
Size
63KB
-
MD5
e4f101f59ab8b3923b7266915ac52cb0
-
SHA1
90311c579cc578a43097255d707cb02dbefdb755
-
SHA256
23536e667239c0b531be4667caecb04f4eec7962be4bfb05d8406668dfe3cefa
-
SHA512
ef19637b56ba7d23870f8f9efff9d58780140ca661bb708726a695b7145cd1e186487f7d0ab070aca40c6468c9794f61351eb44ed3d60a6599451241075fc4c4
-
SSDEEP
768:EcENCjdJIO4VBafkABbXSPo5mR/TWbxYLMCnWvhgpgrElT0lYioRojXq5FZ:EcVEO0R/PgYgrElJojOZ
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\ORBD.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\RMID.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\EULA.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JVISUALVM.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\KEYTOOL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\KTAB.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JRUNSCRIPT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\TEXTCONV\WKSCONV\WKCONV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTA\8.0\X86\VSTA_EP32.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JCONSOLE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\LOGTRANSPORT2.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\OFFICE SETUP CONTROLLER\SETUP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAW.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPENC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\TNAMESERV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\MAHJONG\MAHJONG.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\OFFICE14\FLTLDR.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\TNAMESERV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVAWS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\SETUP FILES\{AC76BA86-7AD7-1033-7B44-A90000000001}\SETUP.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\CONVERTINKSTORE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE14\MSOHTMED.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KLIST.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVA-RMI.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JSTACK.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SCHEMAGEN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\WSGEN.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\JAVA.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\TNAMESERV.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\RMID.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERIALVER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\PURBLE PLACE\PURBLEPLACE.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACRORD32INFO.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAC.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JABSWITCH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\KINIT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\POLICYTOOL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\CHESS\CHESS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\MICROSOFT GAMES\HEARTS\HEARTS.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\READER 9.0\READER\ACROBROKER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\DW\DWTRIG20.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JAVAH.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE7\BIN\SSVAGENT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\APT.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\IDLJ.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\JARSIGNER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\BIN\SERVERTOOL.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JAVA-RMI.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JP2LAUNCHER.EXE e4f101f59ab8b3923b7266915ac52cb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4f101f59ab8b3923b7266915ac52cb0N.exe