Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
Resource
win10v2004-20240802-en
General
-
Target
b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
-
Size
44KB
-
MD5
7a3770eb9620a0bb2989536e38ca94d0
-
SHA1
e9bc9ace1a13230fadb61cbe52e728334cc5f1af
-
SHA256
b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70
-
SHA512
608e8e0afff5941a37e71e6f3e0759d26b353a5ba1c6289584098075a5c7030b6bb5929f3f20704be7d35743949735fc153ea6e30692621aee6e6b218652a05d
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0IS:/7BlpQpARFbhNIiJwsJwwnZS
Malware Config
Signatures
-
Renames multiple (481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\Parity.fx.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Internet Explorer\F12Resources.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Eurosti.TTF.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Internet Explorer\F12Tools.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Internet Explorer\perf_nt.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe"C:\Users\Admin\AppData\Local\Temp\b8d0f64bc98553db3d61605769c80359f546661a5d8c7ac8029c1d63e735de70N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD58fb4829c288be86c6f426eaa4791ab85
SHA1821703d584ab8920db8ae647212aaed36b7061d9
SHA256582d5fb9bdc9dbe074bee556de7b2e3bf657cca7394b07d2f3babed93baa6463
SHA512ded092799c3d1ad51f924da5131517f610eec4e8e8da9bff5113c7a7b38dd181198fb55be5ef8e2a22a7a14f0c9fec405c462ca29fa777ccf845d499d161fcc3
-
Filesize
54KB
MD5aef7fb1e76eba10452355c2b1e678f2a
SHA1db8078fe356db454867bcff32a69f6a0496cc024
SHA25661d748bac5b9b4bb22b2aecc1279a79db874b4a02c8236745b9bdc8ca3edff62
SHA5126ed68624af90aa5d06f9bfde15b74f5bfcdfa978a6c9f693c34fac010926ef0a3f9faa41861e41dcb16507f487e0b9741823f84f87bb143f3f4ed6436bef645b