Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 04:17
Static task
static1
Behavioral task
behavioral1
Sample
b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe
Resource
win10v2004-20241007-en
General
-
Target
b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe
-
Size
50KB
-
MD5
bf7d36e3dd796107f570fb1206086730
-
SHA1
01b71ad4a16d4d70249d69c58a5e19d3731f4024
-
SHA256
b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09f
-
SHA512
65e5100d597c2c2478f7e85a718b093e7950b927b1c187e843ee4449238fdbbae2da6a80a578d1a59aa40bf54a955a3c211e6d53afa6b0328e202b249dfaf6cd
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5lsSThy:W7ZhA7pApM21LOA1LOl6vSQ
Malware Config
Signatures
-
Renames multiple (330) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\EditImport.mov.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe"C:\Users\Admin\AppData\Local\Temp\b5c104b8d8e6cc7b35f5fb5f3eb1135b0108bbfe885d8a392d5b5f8c50cdc09fN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD57dba84de3f2500367eb22a170f93a512
SHA19a80d27f6199abc4cd777de437fead44f7206358
SHA2561bcdf6abf9e8ce29a8d9264fe79457dde5c16376b61468e48472098cdc374a64
SHA512d98d557cfbc9371f58b47984ee2b0f111a61c768d6cbe11bdfa703ddc3c08af812b1757b06067c5743744049f5f96eb2952fc0e6905a9e56f5bcf0dcafbddb16
-
Filesize
59KB
MD54e9745fc38180a0f11d137de95335cae
SHA10d63c78257ca805c94b36671ee7a9774f56aa55a
SHA2568d6f8d53f7d63f4746ad5010fdbde38356ae1249c82fdbb6739dbcd22ffecf09
SHA512bd99e138414758a1ab503eed218209e624364c5892ac98fcf87378c9c8fdddb0b469bbfda61f8abce051ef5e01479cdc78fea2c468ea197df08478aece42a1d3