Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 12:23
Behavioral task
behavioral1
Sample
Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe
Resource
win10v2004-20240802-en
General
-
Target
Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe
-
Size
33KB
-
MD5
cc7b4696b7ef0df8aa053d4a2b63c496
-
SHA1
1bc0243d6e758bf3fd693e78ede503952920897d
-
SHA256
e366dbe0897b08d051991e34f934c977286de901a02d2b5d101c0f95d91f83bc
-
SHA512
66440ec1432756d7b5bac62384ba8f6ee428b54164d3916d89b5ae1e8d60f86b164f64b54dea15a40dbd0165851a5009b1616829215e68362f7d840d97f04b27
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9pQ9HsQ9H89f:CTW7JJ7Tbgsg0
Malware Config
Signatures
-
Renames multiple (3462) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2696-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a000000012283-2.dat upx behavioral1/files/0x00020000000104da-6.dat upx behavioral1/memory/2696-63-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\DVD Maker\sonicsptransform.ax.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\GroupEnable.ppt.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_cc7b4696b7ef0df8aa053d4a2b63c496.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5f585ef50fc3b0c4873f3af810d11285f
SHA1870603f5aa91059cf225116b1404874191f82184
SHA25683da6b642645172cb15e76b63ad3ebc967b123a625b9453760c14f1d1a9276ac
SHA5122bb88b4e437e478c8f8b9a25a13c97f1e15725cd7eee474bf1db812ed4d73d9a1a2bf0e9006e02de7f55dca0ffbacf7d2d16172eb47ae2b56073dedfb437bcfa
-
Filesize
42KB
MD597ba85294fbbbccc43c7e6ea1c85eec6
SHA1a2ddbb278db40a834113710e2ce8582f8c502612
SHA2566a72056b0526d445ad27a49b16ff07bdede735d2e017adcd25bd72020427bb0e
SHA5126ad5ac73fd3df8151920d7753f0ae8fe3e2d1d3d34be45841c4d8b52ce1c77e8beef63dba30802c62c0d34eea30bf9de41f48a432729f1634c39ac20f182e497