Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe
-
Size
36KB
-
MD5
ae2c71a44e5d67d35ca1045b5bc2b9e0
-
SHA1
f017b0ab1ebe772c981c05f80a18aa9c739f9b6e
-
SHA256
51e1323111ad6c92f6aff17f39b376c0ef9df5888c99f39f8eea26bf601e91a0
-
SHA512
609de5cfd334225f56d656331b56feb133a1b6b9e576f137dbea0d9d7ab15862a42c80ec80f19f4165109145fa21a84d0dcd88fcaf7f94c617c70c519911a2c8
-
SSDEEP
192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHA9jxje6OMmy6OMmI0:yBs7Br5xjL8AgA71Fbhv/Fzzwz+
Score
9/10
Malware Config
Signatures
-
Renames multiple (337) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\nn.txt.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\7-Zip\7z.sfx.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\ExportSuspend.temp.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\Common.fxh.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae2c71a44e5d67d35ca1045b5bc2b9e0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD59d638d26e001cca188e075a8a16dc165
SHA14e17574aa6da4ca6fd920fbe8ae5000316090dac
SHA256fadc6d98fb2d2ddb2efe9511fd76d9fc128ac7f3dc8d0c2bb44bcffad56ae104
SHA512b73d416cfb6adeaf8360c3bc1fef7fcdf094da83b848ab3818c328d1143062e7dcd46401b7056df1e6f09e5cc4b1e9db96b8f5787d5c9baa660808664338ecec
-
Filesize
46KB
MD561f2c4291bb0a1a380b7e31d38d83f15
SHA193647ba30b9965d6a8d6b9c63c0930a8eabfad6a
SHA256cf278360ee63db3235b15774dc9cdaec0b729ecb8b5079ab155be986418d76f1
SHA5126aeb058a74d7d2db4f6eef8e2721504f6b6cca153050a64d9b7a3d86570cbcacfbbf99347ea6f3e6bffb964200c06c7569d8847d2ab554347fd7347cc200d744