Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 08:00
Behavioral task
behavioral1
Sample
43cf6a118438bab9f38f3e8f3bf46150N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
43cf6a118438bab9f38f3e8f3bf46150N.exe
Resource
win10v2004-20240802-en
General
-
Target
43cf6a118438bab9f38f3e8f3bf46150N.exe
-
Size
58KB
-
MD5
43cf6a118438bab9f38f3e8f3bf46150
-
SHA1
852077483bf15d9684a6ac050529171d0263453e
-
SHA256
6b13be9f29a56f850950a53b9896b2e151187dda33caf07b46b7d26c61d7b175
-
SHA512
e450ef2127170d6356fd1ca4f5ae8a0b2ca7deb6465921cc64bcf6cbd3a35037bdbb0cd277381bf0ac4f930554b00f846a63c0897f2c13666df8eaaf5e0c26f9
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiPUN+:V7Zf/FAxTWoJJ7TTQoQcN+
Malware Config
Signatures
-
Renames multiple (3258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00080000000120f9-2.dat upx behavioral1/files/0x0002000000010617-6.dat upx behavioral1/memory/2336-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\VideoLAN\VLC\Documentation.url.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\DVD Maker\offset.ax.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Internet Explorer\F12Tools.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp 43cf6a118438bab9f38f3e8f3bf46150N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43cf6a118438bab9f38f3e8f3bf46150N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5f4eeb1bcd278492f6636c9aa3e69a67c
SHA1e525571509d7a992073a13312fb3e3a14f60365e
SHA2567d27ee4fb33cdabb59042f24f60040ed825f37c6f4e40a98a306af9bed65123f
SHA512d32f89f64821f7d29024e3642c5d881488d3755175ba67fd2db7f9574331be7a1ed42154bfcad663f5c95cf46c85258219be4c5902e0282ed214dd756813ddaa
-
Filesize
67KB
MD54c8d177f49f5e3e799430c3e682795ae
SHA141aeb350c7a30498883266b13f2dde48a53e3684
SHA25658af4ef02a856f67a07f99600bad45b21b817344c593c490396c481a918f773b
SHA512be68141919148b14b477b155e331bd112cb42caddaef085956866dc622f07b2ca4716a2c07dfcc8285ccc0020c08eba434081c2582992ee33ccfa67cd50af6ab