Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 10:56
Behavioral task
behavioral1
Sample
9ea95262a77e9d8728942cb088970de0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9ea95262a77e9d8728942cb088970de0N.exe
Resource
win10v2004-20240802-en
General
-
Target
9ea95262a77e9d8728942cb088970de0N.exe
-
Size
137KB
-
MD5
9ea95262a77e9d8728942cb088970de0
-
SHA1
eef3e8eb3cfdaf01fa5e741e11f4aaf23b9d14a5
-
SHA256
87b5231fe7f51da0d43f42ffd85f64176d582ca5b8ca41d1ad6ed92f88cf70f6
-
SHA512
7266cf4ac2bff082f37c1b37542417108fa96d1beabbb5b52ab4fa020d60595eeee19e0e0981a74776c70faac9c91e8580320cae313a8baa80ca3b0656bf12ee
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTETWn1++PJHJXA/OsIZfzc3/Q8IZTN:fnyiQSo7ZAQSo7ZheS
Malware Config
Signatures
-
Renames multiple (293) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000012250-2.dat upx behavioral1/files/0x0002000000010480-6.dat upx behavioral1/memory/2952-26-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\PipeTran.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\SecretST.TTF.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ea95262a77e9d8728942cb088970de0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5050750268672d4dc45452e9e9b0ae3aa
SHA1895bd073e74d384b0efb61ff81c049f2078f80e9
SHA25625d8ddeba3a72783eebee982bdf2ef641f78da1d902c45bc70df7dc8108728af
SHA512c2052d194ad1f182297c87edb0073103dbfcd843d024ac295d5bc37d61842e2729d029d14a3d3b141dbeea82c9b2b54270a37cefc249473b53162dce85ceb564
-
Filesize
146KB
MD51bd0bb47d9decb1d451b922f39bdc3b7
SHA1767bc49c77f6cfcd432a04a43b8373dab7cdb09d
SHA256fa886bf190f7bc42230d83c2871a606d9a9fea26b8a784256b196773693d98ad
SHA5128b4f0be840f4b35b90ee5517f09abab6476d208e85647bf920bc248e3a77cb61bf36c73a27ece0eb88dc5777f5178885da3db8d6078d835fb463b4d21a781589