Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
19/08/2024, 01:17
240819-bnc4rswcqg 919/08/2024, 01:14
240819-blngqaygpm 919/08/2024, 01:10
240819-bjw13swaqc 9Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
4b314081bcb5531e368729bd169b6520N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4b314081bcb5531e368729bd169b6520N.exe
Resource
win10v2004-20240802-en
General
-
Target
4b314081bcb5531e368729bd169b6520N.exe
-
Size
76KB
-
MD5
4b314081bcb5531e368729bd169b6520
-
SHA1
26a334cba2d2873df0fd811dba841622208af408
-
SHA256
5483aadefaa81c09f0fe892527ff0003aadf557f64a0fcf5486618e80130abfe
-
SHA512
3a390a26faade5c9b2efb19dba187941ed28faba4b3ae74513ef27a7f68f4a3a756e7a0459072834ddd53869bcf5dcc58e042a685e71171ed50bdfd56466274c
-
SSDEEP
768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBwzEd:/7ZQpApze+eJfFpsJOfFpsJ5DL
Malware Config
Signatures
-
Renames multiple (1026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\CloseConnect.mpeg.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\bod_r.TTF.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\ConvertFind.au3.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp 4b314081bcb5531e368729bd169b6520N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp 4b314081bcb5531e368729bd169b6520N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b314081bcb5531e368729bd169b6520N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD50d5fba0ab72b6d507bdac8784997e8fb
SHA1bbbc48c9c9b5dcedcb7bbcb811d139a882e38d57
SHA2560dd5a8fb559b0ba904e8398474fa56711f8c22c405c934afbb32829bdc5d28eb
SHA512e398cde12f096bd047a32cb75058219cee1284c5cb50717cf7edd1760bd09ad805e68e98fe8aad966224dc1b24b9fc62181c2f623a35fb3188800062b4b9869a
-
Filesize
85KB
MD5a3945b544867b968c851944843149abc
SHA1e06fa3d80be60dae4dac221afbbb3791e5800ad8
SHA256bec3e66cc95970ea4edf1cbd7da4cb6e74b518f4287bc055ec80082d334ce748
SHA512c87082e71b6c90fe8c1c98d9ce8c8d63d3277e6f4eff2f3cc45c4505edb61a8018ba787c06f704ddfe6491c8103000f5449a3fa11b127c9c106322cf7f37c07e