Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77ecbf499d84691d6433e491097a0fc0N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
77ecbf499d84691d6433e491097a0fc0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
77ecbf499d84691d6433e491097a0fc0N.exe
-
Size
41KB
-
MD5
77ecbf499d84691d6433e491097a0fc0
-
SHA1
28644e7c6178791b5a57d283e4f8243f2fcd3cab
-
SHA256
5b8eb928ae32abdbce4f73f81ecffa35f9ff43fca6bac93552133106c47effc8
-
SHA512
f28a2f0f4df07553c357065c74ed930f47e2a0f03a044c2238958afabf7419df3b20f40e0f2be8577427b179a11e865e61a8fc01c28435c30e79169ce6463bc9
-
SSDEEP
768:W7BlphA7pARFbhL801VvM801VvcR2+lJtZ2+lJt9:W7ZhA7pApw03vR03vcltdt9
Score
9/10
Malware Config
Signatures
-
Renames multiple (662) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\descript.ion.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\History.txt.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 77ecbf499d84691d6433e491097a0fc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp 77ecbf499d84691d6433e491097a0fc0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77ecbf499d84691d6433e491097a0fc0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5fb6d3d1c58b87cbf46474052c18b1c21
SHA1f00cc39528cc73ecaa265710e21af8f7cc57ea04
SHA2560afd958a1f4a588ebf13f4b71e24c0cc2d4bdbe1a6bfc5df7effc3bd7a22b8d4
SHA5121f32a54d744a257a059988ae84c7a3de27dc152e5b45ed68ad69704ed0913903a803bab4868daafddb75ba914c2ec74eaa72623f95603bbb93c5110f7f4cd3d6
-
Filesize
50KB
MD55eefc90add6ea1056f704c710c9c5c25
SHA12e93c94275c29911ca7300bd02e2f24ffc122896
SHA2568b1cae5f5a0d0ddfb9d42511732054d2600a3e701980977708d576236105a52d
SHA5127bce6b2113c40cf150fac0cd7cabfc4a3eb887df2a91326d13b655a99ef9e99a4c235532f19460a1a84dd3aa97678d65a871dabe3d8688aaec1a539c41c4ba86