Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3410d39570191606215cefcf9837000N.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
e3410d39570191606215cefcf9837000N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
e3410d39570191606215cefcf9837000N.exe
-
Size
40KB
-
MD5
e3410d39570191606215cefcf9837000
-
SHA1
3e17e6070fded7b0315ca004fd2914d0c097949c
-
SHA256
45f47a3b60ab87be44aa846276888222857c349e7e7326a5e14f9d8057ee1c3f
-
SHA512
73f4749b1a785b90c603200fe1caa3261453854e334d6ce1bb39e5bb2f54e58d57447bad16038ed0cbc92f1834d01a477e2d6ef9e05861b83c1f843fa74d5727
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LObC8p8tiOeiOF:W7ZhA7pApM21LOA1LOiiOeiOF
Score
9/10
Malware Config
Signatures
-
Renames multiple (331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\kab.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp e3410d39570191606215cefcf9837000N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp e3410d39570191606215cefcf9837000N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3410d39570191606215cefcf9837000N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a83f085c5cf7331aca59bea5fbace635
SHA1ae2eed07145d74fc097cb289c940be391527cd91
SHA2560ddf8d24a2cd703e1892db06da449325feae1b5599aa9de8961baf37141213e8
SHA512f130726159d847b486272f82931075abbb9ecdc98edf84a869ef3b16f9f2d30e529f5ef4b6138807e68fe1903a8b1473f4b3a6fad249a059ec742cb6655e35e5
-
Filesize
49KB
MD507c5d31b4618e41d63c86a6fec582ad9
SHA16826470e053a8102496556d9b5f4bb6163335d40
SHA25621dcc0d1b5d5fcec3d741c67b71f20ab38c4978c03ca03c0b0a486289bdc2916
SHA51242109b310dd7468e063d7424194105a053db4d64d0cbc1fc89526a34234115025a2e53c85a70e2d88cf3955ea63a4729437ec32fd7cddf6c901bc02d0f78cea0