Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1038f792a175...c0.exe
windows7-x64
1038f792a175...c0.exe
windows10-1703-x64
1038f792a175...c0.exe
windows10-2004-x64
1038f792a175...c0.exe
windows11-21h2-x64
103dfaf477d5...a7.exe
windows7-x64
93dfaf477d5...a7.exe
windows10-1703-x64
93dfaf477d5...a7.exe
windows10-2004-x64
93dfaf477d5...a7.exe
windows11-21h2-x64
9801505b222...4e.exe
windows7-x64
9801505b222...4e.exe
windows10-1703-x64
9801505b222...4e.exe
windows10-2004-x64
9801505b222...4e.exe
windows11-21h2-x64
9be7c6e308b...8e.exe
windows7-x64
10be7c6e308b...8e.exe
windows10-1703-x64
10be7c6e308b...8e.exe
windows10-2004-x64
10be7c6e308b...8e.exe
windows11-21h2-x64
10ecfb5c95d0...9d.exe
windows7-x64
10ecfb5c95d0...9d.exe
windows10-1703-x64
10ecfb5c95d0...9d.exe
windows10-2004-x64
10ecfb5c95d0...9d.exe
windows11-21h2-x64
10Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 17:30
Behavioral task
behavioral1
Sample
38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
38f792a175c366b53407143da8c13ea2f1d3600b00ef8e8f6ec7e0ef79dcb6c0.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
3dfaf477d5058014e308f079fdfe1e9c765f3280c0ef105ddd0efeb5c9b0daa7.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
3dfaf477d5058014e308f079fdfe1e9c765f3280c0ef105ddd0efeb5c9b0daa7.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
3dfaf477d5058014e308f079fdfe1e9c765f3280c0ef105ddd0efeb5c9b0daa7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
3dfaf477d5058014e308f079fdfe1e9c765f3280c0ef105ddd0efeb5c9b0daa7.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
be7c6e308b1d8a20cc46232fc95f6c094717f05cadb0c7a03108d969b561f68e.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ecfb5c95d0f3d112650ef4047936e8fa5244c21c921f6c7a6963e92abab4949d.exe
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe
-
Size
18KB
-
MD5
f31d6529ff4ad98053f9a8a9832f95e3
-
SHA1
abdd5ce48e2d11a4c82fc90d9e9beeb14b437cee
-
SHA256
801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e
-
SHA512
25e452098a46f3ddf3cc6e268a94fa998d7c0de907741f436d10caf7be8c038163dc3a0f51516f3b4072085951eb5e44053b2e9f84a532c152bbf813a518a755
-
SSDEEP
384:imwIxiBDXgRUV7JCGgmxt8mvA4ILbfNGHEDPUw3rXTXLazK:i6UVl7twPbfg2Uw3HXAK
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (207) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\Downloads\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Saved Games\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Documents\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created F:\$RECYCLE.BIN\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Documents\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Music\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8O71085\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Music\Sample Music\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Videos\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Recorded TV\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3W44XPEP\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Videos\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Pictures\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L7XNHY48\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Desktop\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Downloads\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Pictures\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Libraries\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GKATPXW1\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Links\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Desktop\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GUJ7UW2N\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Searches\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GY8QW6M2\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\Admin\Favorites\desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1512 vssadmin.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 880 wrote to memory of 2620 880 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe 31 PID 880 wrote to memory of 2620 880 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe 31 PID 880 wrote to memory of 2620 880 801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe 31 PID 2620 wrote to memory of 1512 2620 cmd.exe 33 PID 2620 wrote to memory of 1512 2620 cmd.exe 33 PID 2620 wrote to memory of 1512 2620 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe"C:\Users\Admin\AppData\Local\Temp\801505b222599fb1b73dcf02ae754566bbe0ba03cb253592bc585b639f65f04e.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\system32\cmd.exe"cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5eaad12a46a0053146c9dba2fdb67fdec
SHA18c3659922b7b6f3f951b9eda3aefc1839194b63c
SHA256fdc60635a043081645af457780f58ddf754c16075e0b2f16e60b6fba1ca20139
SHA512b7acbc365df9afd3ccd1f6ee2118ceee259de1d1c4db67b06b0271eb823cd221b9d80fe171a0fbf7b74775301b9b574b87b75ea824549dd9ba1a2091316ff546
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Filesize48KB
MD51eb4f4f78e3178ed4891dbbd4194b99a
SHA1efa6a56f167681e687c2b4be8ccc6128dccddeab
SHA25691119d188d96c652e17ddd4f02b942af77575e152324ac0866ad68cc10a23730
SHA5126dfe419dbe2d3ebeaef7a934172ec5f1d07517d845aeae448eb2f7ee705532d954b9f10271901d136ea6eeaf6785343210f249f508c027700a3df632a02beaed
-
Filesize
10KB
MD5e14c4092aa8772729a2843b47dfbff31
SHA117b744a9fb61e9cd71bfa063b6d5f150c22424f7
SHA2565f3793e0cc3522dc1c83a4c8195baa47a0af0d4c30f256b53afc70c83f05bf39
SHA512f57e61738ede14193fcf563f3807fa9755ac1dd49dc9fc342405cddd241ec3d1ec412c42a4a795f7177c3a5b556f8b2e1ccf488e10f4a2d55657b52ba108fff6
-
Filesize
80KB
MD53b4f0b88ad8898db67ce65e323099824
SHA16d5ff665551aa95fe5c34ce2323c4af01274182e
SHA256ecb94ea77befc7ae592cbe0d8f66710739d97c762dd99f9125094884bdaa0e67
SHA5128f15d858876f45372c6c4cdc2718d374dff6c074d1633b488e2b27d2a4121ea386b510cf11748697f31547163fe29db7403f124fde220dc81ce9a0dd07baa0ff