Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
bdc647a8e11cba7996472b243b9bf990N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bdc647a8e11cba7996472b243b9bf990N.exe
Resource
win10v2004-20240802-en
General
-
Target
bdc647a8e11cba7996472b243b9bf990N.exe
-
Size
78KB
-
MD5
bdc647a8e11cba7996472b243b9bf990
-
SHA1
c081f008467539cb9c1f75aea13fdf11b827e506
-
SHA256
77da85a52831041ecd6b8f6b19f47a8b354e6944bfa6a1b1baeb94b212371dc9
-
SHA512
34e03ff6e365e31ca798ddac78939d1a82a5aede720b1f47898fee799b08cb0fffe118b9209553fce19b447ee931e511c1f8d91f9ce3c7a6f158f3af5f9da754
-
SSDEEP
1536:W7ZhA7pApMNcH6gW4Wvs9s2cic8GhGvnQw2w+5vC5v8:6e7WpMNcK9vG1W3w2w62E
Malware Config
Signatures
-
Renames multiple (331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\sonicsptransform.ax.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\Parity.fx.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp bdc647a8e11cba7996472b243b9bf990N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp bdc647a8e11cba7996472b243b9bf990N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdc647a8e11cba7996472b243b9bf990N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD51fa88a4415a86f52d5ae29402b06b9dd
SHA13bb76942f57bbbbd7cd83107cdb5a5ef6d8e97b2
SHA25619089e8a92a19ad8205a02a4294bcad7be946d90a45e88d9085e1fb546286a97
SHA512791e0d01e827a0e5ba611062ebca3515793ad231387cf365b205bdd6fa3d80198fc9fd3047ff5860205db315e4cc8a95b6e6ba1e6f26172b349e171b5e328e09
-
Filesize
87KB
MD5abaa9bdd27bc7fd9fcc809acb356fa88
SHA175c0f610b5ba0f20977d5b71dc82488ad9bac1d4
SHA256cbdfeef880b7d3fb436a71c54130c764333b01887b99b178317138b74b88dd55
SHA512f409d4a9ee0ecbc0b6564ce392b0d6b9cb6e31dec2ccbaa31dd966fffb4afb91c54fe7ad0bb1c7707b4dffeb4c1c2f5ed767e01bbe85c41d5d6887f33ff04573