Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 12:46
Behavioral task
behavioral1
Sample
Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe
Resource
win10v2004-20240802-en
General
-
Target
Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe
-
Size
115KB
-
MD5
5fe93dc75aa60c93321b4b91b1ca81da
-
SHA1
e881e6aeb09e0fc96f9c75d5d420c41f34651d2b
-
SHA256
8071fa5a060b5851fabe87f01a7188b57c3cac021aa01c42724d393f7cdab75f
-
SHA512
d36c0235e290f4362db25429e32b613cefd21abdd1da4f150ebb396c9003dbad1f7493bb280afc3dd7d833d6f277c7aaf501154064ec0880005b8cf40b71f2f2
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTNyl2Sm0mKuC1TC1PM1mM1XUUgWIVD5IDaGZC09c51+EGgSf:fny1tE42EXUU7964ExSwDG
Malware Config
Signatures
-
Renames multiple (2850) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00070000000120fb-2.dat upx behavioral1/files/0x0002000000010485-6.dat upx behavioral1/memory/2716-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\FormatGrant.vdw.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_5fe93dc75aa60c93321b4b91b1ca81da.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD56389a72c7c6bd507138ea43901793751
SHA120f08de35b561f1623a0ed634a89246e80c9cd32
SHA25644c197f9073ff2e5bd34001806c813d8af099e0de2166787dca22cbdf82921ad
SHA51271757b339c2b7641be539f40030129595902de7776a33e02a6e2a200f1aaf4e725c91f828c652d2974e0de244e954df200ad459b14b313a17af23a5b1e1589ee
-
Filesize
124KB
MD5d670be1bd5a9bb8822a74f8ad0097231
SHA157ed60b05307d7b4d407d65a33e578040e5960e4
SHA2569cd47eb2dde417e1f211d435bd96baa92d5e6b0166fe9790bf15012afa150ff1
SHA5126f6626f2d692ae62015f06b21b64bd086c8af65d0c9b9d3c7c31bf4ed13f2178e13a09a5978693276eb009ad2328096e53a671582c4cc36a946b4a652ccc883a