Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 23:18
Behavioral task
behavioral1
Sample
71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
Resource
win10v2004-20240508-en
General
-
Target
71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
-
Size
70KB
-
MD5
24d72afe3a6e66698b0bf805b43a24b4
-
SHA1
1a03a2363c3f6274baf3b7e899b58e560eca1944
-
SHA256
71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039
-
SHA512
636ea194cd63e4a53ededf82c272291988707d414500302d62bcff4ebae01931dd89362a6759d423aae5e9de737dc00fa63435235acf36a7483e75f4839eda45
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsXaU5:fnyiQSohsUsB
Malware Config
Signatures
-
Renames multiple (738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/1612-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/files/0x000b000000015a2d-2.dat UPX behavioral1/files/0x0002000000010481-6.dat UPX behavioral1/memory/1612-74-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral1/memory/1612-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000015a2d-2.dat upx behavioral1/files/0x0002000000010481-6.dat upx behavioral1/memory/1612-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\7-Zip\License.txt.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Internet Explorer\ie9props.propdesc.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp 71f460d3e77c170fd2ccb8f7c038a4923e0f4445c5c064583bef99f29c2a2039.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD589b66403b54b4d234768162fa7713e24
SHA11c323f0801f6dda46efa99684b0929534f4261d2
SHA2569df3f694e32ebbcc242521a26f350641bc075da7bf31239dc500b61438fbeb95
SHA512a45117a8f79fbea5838d59fd1dbea02a05340599b94a711a47fdf0ecb9d43605d4b62028bb1aeba2cacc9781df7b89c0ece93e7349c58e646096ed2343288c35
-
Filesize
79KB
MD561a8c51c2aeaddad84e509df6540634c
SHA1783ef9b7c127aa4850339211322fb1cc45cd293b
SHA2563fc608fa96586c073bfb70e55b7f192ffbe9d29df7a72b1c3355f2715e61de0f
SHA5123459a8f47c6689f018adb958c407b1f700c5700e8a017345774f07fcf1518b6ab7f481953de406c805cf717a5f15f0cf4f139327bd6beab965b4e103f5f4a26e