Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 03:31
Behavioral task
behavioral1
Sample
4abbb8fb29de681e8ab6824c2657dad0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4abbb8fb29de681e8ab6824c2657dad0N.exe
Resource
win10v2004-20240730-en
General
-
Target
4abbb8fb29de681e8ab6824c2657dad0N.exe
-
Size
23KB
-
MD5
4abbb8fb29de681e8ab6824c2657dad0
-
SHA1
8a35c4044cee9e0077db2c2b628b13c1082c74ea
-
SHA256
947ffad0ac547a5277c60f59b2f63c73a59779852f35655fd43604b86cb4be2c
-
SHA512
412ac8d674205324e7e2705a690fbafe92b040d06ec5be657b246be04e8a274fcef69fbc6898fd1aada1cf7233691879a7a00eaefb900e1d058d49abdb134458
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJcbQbf1Oti1JGBQOOiQJhAT17Xw+EAEE:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJ0
Malware Config
Signatures
-
Renames multiple (507) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0004000000017801-2.dat upx behavioral1/files/0x0002000000010463-6.dat upx behavioral1/memory/2292-28-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\PipeTran.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\OmdBase.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 4abbb8fb29de681e8ab6824c2657dad0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4abbb8fb29de681e8ab6824c2657dad0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5b5cb57ddf8a3a2f989fd9e3ac9928552
SHA17dc04dfe21904564aff00de3b8165825ed62083b
SHA25628988b56a6fb0876b3d5577ebe82a1f4722ca83549f2f43e6471c4bb0983023d
SHA5121e61d20bbb10943c0c0d95197280d9bf575339594190e5970fad05fbff071f6e55ed79552cc1ea0a3a9496922303bc5905b1c5b992869b30a254db825688cc56
-
Filesize
32KB
MD5654bb04add1f0df234941527a715c9ec
SHA11725b4b35339899a0a5ec93430746e2d5cf863a6
SHA2563946d942c9e0b0b1b375b9fde6d8c75a769874b03e41c281a9df88478a3791c7
SHA512a2ee2e97ccdc64fa919061c50f45a453f0646d023822a7567da4e24152f7ce1bc93dc905bc11ccb7170de090cbb8c6f00a7f9cca8251e623bdfe59c80be93c00