Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 03:01
Behavioral task
behavioral1
Sample
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
Resource
win10v2004-20241007-en
General
-
Target
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
-
Size
1.1MB
-
MD5
91887e7852cdffe968fd529e3d47b4c0
-
SHA1
aa0efe7f6326f49d7633535de28d154e8ad735fe
-
SHA256
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4
-
SHA512
761a95014539baf0a5c94ca994fa4ef94f5515145bf66d339051ccd928a5890b03038af939899f9f212aefc663bedafba650c6fbe7704ba3c669c996df9f5fb3
-
SSDEEP
6144:KbEQl/lLlHlKoJoEoV5oV0rlrgrgrtT8TBTSTQVCA2VCAMVCAmVCAbDu+6JmDu+T:doJoEo/o2rlrgrgrtT8TBTSTf
Malware Config
Signatures
-
Renames multiple (484) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2440-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0007000000012116-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2440-62-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\7z.sfx.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\rtstreamsource.ax.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe"C:\Users\Admin\AppData\Local\Temp\bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD581755f61643ab19755cd06d5b3a18b27
SHA10d223e2417f5c0b40126b9d929d6340434908a3c
SHA256bfa5c19a5c07821ffbe34082ef0ca28150fc684a86b1ee0ca7575ad29f3722c5
SHA51266de5339eca832d0a8a51c547c8cb97d67b93bc49fd3f731cc5fdfbf1d1ae66eee01b2014e839abb79958078f2a807f8bad7f25740c521051b8c32cdfeced7dd
-
Filesize
1.1MB
MD5e86d64f3e0cff205b865332a138fc3f0
SHA1ab516da986d3ee2347e5ab8470b4d2c1f925207c
SHA2566bf0c29f48d31e5ec0d775c664032fcdf1444ca2605bcba78d95fb973871768d
SHA512c59aa870c51c3f903c87fe9be1e685dead14acbf4c17004d82a77da9aa27ebcfa957efefe91855e256ca9bd0dc72a7af33f4cfe422e3918b91355796ae8b36f6