Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 08:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8389cead0fec90d623e53d0224e503b0N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
8389cead0fec90d623e53d0224e503b0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
8389cead0fec90d623e53d0224e503b0N.exe
-
Size
51KB
-
MD5
8389cead0fec90d623e53d0224e503b0
-
SHA1
f578fe42d82d858521d38fc51f177a2d6d2a767e
-
SHA256
dbb59fe3de114613ac4f8bd8598f6bc35aef1c577ee5fd36d9797de80a819a4f
-
SHA512
752dd54aeea0003f0e440e20ffd7dcdd6bf3df07d6f1189ce2c5e9ff1aadc9ca0abefbdf1e4f576e4bf509df0b644ce5f6f18c68f35446c8e07b21ecdb640512
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0IOe2eQOUaHOUae:/7BlpQpARFbhNIiJwsJwwnZOe2epke
Score
9/10
Malware Config
Signatures
-
Renames multiple (409) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Uninstall.exe.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\7-Zip\7z.exe.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp 8389cead0fec90d623e53d0224e503b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp 8389cead0fec90d623e53d0224e503b0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8389cead0fec90d623e53d0224e503b0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5fb067b61fefaa1bc2bf784a2368d25fb
SHA1d56b86e34fcf95b0a47f4c839615f51bdea04583
SHA256567b7b4e3c86743d3e6f9f0d1e12c7d64ba39df90d07d4b9d2d2ee81f3371fca
SHA51239a0a8b0a60f657b5178f478e8cfc1fcf36a11262dbdc87f7e9ea79ff1554a221298eec6c98ab652c3e0f3f98d8c1fc2de2256cedf5fffe1c1309ed0ddb0ce74
-
Filesize
60KB
MD56d1188d1860250c4e07e3796a9751b9f
SHA10c7883bd9cd751afe1d00d40d27d23596c1db094
SHA25644f482a319bb0131b9e955272d1b307d5fde3ac79b17a27e150949623cedb88d
SHA512001e72a3cd4de1d69a716004b3b4aa742b4214815a27579a2fa26207ba14f4d9e55c0f3f5fafed73d91dad4b1ffac33936f489f7750b73a9821bfd952b0e31f4