Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 04:48
Behavioral task
behavioral1
Sample
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
Resource
win10v2004-20241007-en
General
-
Target
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
-
Size
73KB
-
MD5
8989d069cd157ed8b87d3c3e8a046c20
-
SHA1
0d6cc9d02cb154cdc12ff6513e0b46bce960bcf2
-
SHA256
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1a
-
SHA512
6eb6b25c6aef762f914362a125b7a9ba775f247eed04d9855f8a887a41d40d3c054c52fef6a695e6ec2161c49802209545a79596674ca1406a625bf0d91f2f6f
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiJFEFuodm:V7Zf/FAxTWoJJ7TTQoQPyPhehv
Malware Config
Signatures
-
Renames multiple (338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a00000001225c-2.dat upx behavioral1/files/0x0002000000010420-6.dat upx behavioral1/memory/3012-26-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\readme.txt.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\Parity.fx.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\ApproveSubmit.mp3.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe"C:\Users\Admin\AppData\Local\Temp\be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5962bda65cf8b2247cf1d336bc688bfb5
SHA1045a964975d63437c542c935497a6d2172dab41a
SHA2566b944d074d89188016d02f5dea8a5894f9ff719de986a68db7dc625328c6cd7f
SHA51245c5b78139dde9464ebfe7c5d2cd7082526c70c49b4e2c8574a06d072ad30d33e8b0853b87f3302881f453566ba854adc65094bae38b85daa327bf6f7d782143
-
Filesize
82KB
MD59730d734a1926c85d3582829ade8b944
SHA1022bfcaec85d57435474b0313171bf873047253b
SHA25610ed861ba0a46064691ae6ff5f64f3bb38c59ba87f401f3a462c27b4065226b5
SHA5121e4c39f99a8286c0b2bd472fbceb543e67253ffb30e0fb1acc1a896312a529acef5906da1b18d3b1fc7320749a1ec936b9d7401eefc5ff9c242abfca8f8439cb