Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 11:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
-
Size
83KB
-
MD5
b4415cac8dd4c8e0ec6bd09640c44cb0
-
SHA1
1cbbc4f2b88741b93ca9a776d754d7f200cbb5f4
-
SHA256
f30c81ed4b090ea9da31912bea660ea39320e9a67f9012c5474e2e2a14f9cb8c
-
SHA512
fc1a99b6a3ca5ed8a83a07080d5e57af1c488f1033664f3c4e59537c826ba829c39d61fcef7cbb7a53a291bf0dc47310f28b16d965cc0336b6979a1370d3b439
-
SSDEEP
384:yBs7Br5xjL8AgA71FbhvJUfWGUfHjtmjtd5NaMR5NaBQNNmPx/Pxv:/7BlpQpARFbhiWb8naOnaBGNS1l
Score
9/10
Malware Config
Signatures
-
Renames multiple (448) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\offset.ax.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\DirectDB.dll.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp b4415cac8dd4c8e0ec6bd09640c44cb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4415cac8dd4c8e0ec6bd09640c44cb0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD58e6d45546d9f493b77d8519675c8c679
SHA11e239d12f09492f0d15f53e06325cbdffe6a4631
SHA256915eff7eeab477fe3ef6de6cdb6625ccdf63fc48f376a91762e0f8d9ac22a62c
SHA512bb3daa3064904cf8f5bccf57115f39862187bb48f340ade48810775a8a73b5b68e4d435a35e94ccbc1e5a8d102718c61f98cb20e64aeac14036f9c385561ffc0
-
Filesize
92KB
MD5a8f440e6b2a5d76ebdf95cd44d569bff
SHA1318b8b243ebd6ea43da2dade9707d4fff339a80b
SHA2566bd2cc55d1e6d7b9b3a02148937e9066eeba96dd7835872bb01c7293722b657b
SHA512aa24a92878ab9f261ef29d101bfcc3b60faef0993ded321658850f2f1e3545889d0528530a3327ab77656739acfd03c337de94ad688551e1b38a8f3e894f8822