Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65df4cbd888200e9c9e6503db99a98b0N.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
65df4cbd888200e9c9e6503db99a98b0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
65df4cbd888200e9c9e6503db99a98b0N.exe
-
Size
32KB
-
MD5
65df4cbd888200e9c9e6503db99a98b0
-
SHA1
c27553884931d81e6f4ec68995d71793bf9381d6
-
SHA256
568d810164964e9f3de78a7d878fc2956cadc5c6d0e805e62800926b676bdefc
-
SHA512
912fd5aee26c94c5bbc2ca58678ff2aeccfe7b3710c3c78930093624783508104e39828b3f7be8d2129c3d47d8313d9aff6be05811d41e4db1abb7fa8943a89d
-
SSDEEP
192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxjD:yBs7Br5xjL8AgA71Fbhv/FD
Score
9/10
Malware Config
Signatures
-
Renames multiple (378) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\InitializeJoin.html.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\ExportLock.i64.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\CompleteFind.emz.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 65df4cbd888200e9c9e6503db99a98b0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65df4cbd888200e9c9e6503db99a98b0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD58a590f42482d86df5cdc67c7bfbffb6a
SHA1503c550b3d86de70f7ac7dceb46a774c703ebf65
SHA256991474ea627a71f9852e88af3e4bdeb306966591a395b31b721ba2008300eb5e
SHA512e9412a988000a6ec9a4ce04cd50009c9c52f459a164ee3dfcbaa34f781282bc826e9c8982efb0be958ac8e95c8e9c2dddc1abcafc34df594b38485d28a409356
-
Filesize
41KB
MD5abe9fb7490c022b085a451163231c012
SHA1a95678cf420869c5b966523f5ce42d6e8201f903
SHA2567a0cdb5a32463505f567362a51d589bf56bf3082952ed884cfb5ea7a2efdad42
SHA512b102feaab4171dccf4e308ef57d6bdeac16d5ba0c78acf30d7c3cbcb656527a80407e433b2eadd415fdf06350697ec619a9ebf6ed37caca0114f9a4a17fbd8e0