Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 03:23
Behavioral task
behavioral1
Sample
d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
Resource
win10v2004-20240412-en
General
-
Target
d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
-
Size
108KB
-
MD5
ae15b66b57c4e82445e74b83aa38f2cb
-
SHA1
0a8cbe0d6bf33f7ca0a15dbb731f4aa0aca82037
-
SHA256
d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e
-
SHA512
5f97156db3fa6cfc93a3aeb1827818a3161cba3020f30293ea5f627b2394f4e36421ef5369c33601b11442a0058a808559825825b48eb5e5c782d81dc0739cdd
-
SSDEEP
1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfDPw:hfAIuZAIuYSMjoqtMHfhf0
Malware Config
Signatures
-
Renames multiple (3434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral1/files/0x000b00000001224c-2.dat UPX behavioral1/files/0x0002000000010679-6.dat UPX behavioral1/memory/2868-86-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2868-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b00000001224c-2.dat upx behavioral1/files/0x0002000000010679-6.dat upx behavioral1/memory/2868-86-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\settings.js.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Internet Explorer\F12.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Internet Explorer\Timeline.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png.tmp d55b3d8df152eae407a3410d4509aff1e064ed3b3b0b1ebc7568997fcee7536e.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD561bbe854ec1735e4855b9872060dbda8
SHA1c9c5538d4a34db1131f082d3f8f88a520d592cd4
SHA256b24e20225a4c354c9ceac1d989e36577ad6974736bf5a9f25dd876fc21e1af8f
SHA512c6678b6f0c86f1813b659ed603790570d103a20d6de51b45d8ec32419ca136bbaa78deb04f19dcc1a928af088b5e58216d9244b33f3f9998055083109ac4354d
-
Filesize
117KB
MD58f7b10761deaa35030807457262ff1ec
SHA15e5c30867c4c40b4ddc1de8ddaa08fcb0340cd7d
SHA25689ef3eb0c09b30fcb7ea90525cd6c399c532f66433e99f100013edf9fe9d64ad
SHA512d333ac870f9e54ff39bef839ab91e77e17cb2258cd3ed4a6f38096b36a98df404081ed5221e4f361544d3cb025ea85453cc645ea6f75bbcad07357ca4f7c5dff