Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 04:45
Behavioral task
behavioral1
Sample
daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe
Resource
win10v2004-20241007-en
General
-
Target
daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe
-
Size
112KB
-
MD5
e07bf4806835395084efcbb509eb3f00
-
SHA1
1834358bca7c676566501189f1ea4142b65804e1
-
SHA256
daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347a
-
SHA512
84888f35adc9fd0cd3d3cc4ecdd5fab0e93f4a2262f8cfaa861589dd560bc8f06f68e3781806343dfa488940d586edff9aadc125fffecdb2c5ef466b853cc48c
-
SSDEEP
1536:V7Zf/FAxTWoJJ7TTQoQPyPhehFTW7JJ7TTQoQPyPhehR:fny1oRUhehOoRUhehR
Malware Config
Signatures
-
Renames multiple (320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2272-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000016c1a-2.dat upx behavioral1/files/0x0002000000010420-6.dat upx behavioral1/memory/2272-26-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ru.txt.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe"C:\Users\Admin\AppData\Local\Temp\daa4cd42c55d73b503b0ab02f88994e087aa0d5e39e3e03ff11c75553a8d347aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5357f8a39d7f0eed6648c7f02cddb9717
SHA15e3dc4be2a9acbf00581aed3fb85f4746146c9ba
SHA256a893f0d392d4bee76a90cbb0eecf8e1835709a3bfc3f95fd5fdf9539dabbcc6c
SHA512991537838e4b767b7f9b9b6771681000119d18ed243fbf5d59f332692a09887947f308160d2d195924b23ae77ba5d81431219bad545dcd529b64a65a49a178a4
-
Filesize
121KB
MD5f72c44dad3001856932b277a8d8c34cf
SHA14a27940d8c86a437642882a62d268cb343412bad
SHA25622ce19e6c71e19f5fb4fd4007737e2ee2ee6a202931080ed20d5e861aa96d331
SHA512f1fce13283bb945c2330f180bbe23f9b2bd257757843d56bd52540c8812a6b415bf76370cd6dcb07877ab9d7ab36bade7f5c822222818ac43d2271e90a3896dc