Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3221864ea83f81cc1bc8b36b080de000N.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
3221864ea83f81cc1bc8b36b080de000N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
3221864ea83f81cc1bc8b36b080de000N.exe
-
Size
50KB
-
MD5
3221864ea83f81cc1bc8b36b080de000
-
SHA1
46215e598cc2ec1250fd776970d9d34cc5d016ae
-
SHA256
0016f385395b9da566997851ca1c4b6944d633a9279fccce9e062057be5b7821
-
SHA512
d25846db4608572c6d8d5b56f7a91d230d068c2d297faa425bd95761b2d201e809c7c77bf9cf1131b50f507bdcf671512beabe2f5c3f2bd6540a36431a63fdbb
-
SSDEEP
768:/7BlpQpARFbhIYJIJDYJIJPqAlJIqAlJVUrn5c5hU:/7ZQpApze+eMUL67U
Score
9/10
Malware Config
Signatures
-
Renames multiple (604) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\Filters.xml.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp 3221864ea83f81cc1bc8b36b080de000N.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 3221864ea83f81cc1bc8b36b080de000N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3221864ea83f81cc1bc8b36b080de000N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD57f0286f9a07f281ff734e7a737a4d009
SHA168357b2b02428f02388d0a1d710a78525de11e1f
SHA25627af42b05ffaf8c6b5940324a1512f38cb11349afae62de5a9c3eff12bdfbc4b
SHA512d4c7e16baf19ec5761174397c1465e779cb5ea0c0ebfa5045b16b63b3966ddf4d89b72ddeb209a709730d7370e950d86d40843e6c7427e176e3c3333f1fb9cb5
-
Filesize
60KB
MD542dcef4ad1b1fe63532ce8f9b841aea9
SHA1f8d795b49132085a7d6c9045512c0c9e0d5e21f8
SHA25669ad58686f0ffab8ff2a3c78a4935e90bf7e820deb20e905426f387b28d97214
SHA5127bfdf6335a3e5bf4646123cf596814f3fde8d35d1a4e666b16450aa615883d0cfd22d7576f0e56cfc086f2389385eb4edd18ebc0a68356aa4daabff753abc4ff