Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe
Resource
win10v2004-20240426-en
General
-
Target
dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe
-
Size
44KB
-
MD5
63714a7f27820139e6443296e0d761a5
-
SHA1
530b708c6f2d8601ab71ddf89ef0b2520dc2932f
-
SHA256
dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41
-
SHA512
6c57be9a94dfa7323ec8fe37833c904d46effc2dc4f8ef8acb64f3f7ebc159e975a2a8ec8eb35e81510fcf1610a8754d9a44d7575416cdfb876753b50ae91450
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDc:W7BlpNLpARFbhblkYlkuvIYFWcDYcDc
Malware Config
Signatures
-
Renames multiple (3775) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Mozilla Firefox\mozwer.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp dec19feedc0c6653ed7d54cf62143c4587a31370dde91f6b7ac9fc5443862b41.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD54f81c30c9fd852055013732b9fff3acb
SHA1b88a3144902f72cc1008bf3cd3004029dead2ec1
SHA256fa8255af5d747a9daa3ff09dc6935badc91458b6d68b2378ec68b88cea8c626a
SHA512c06d083ba6d51273dab2fa41aaf51daaf6af448c97166dcc7e3cd49d1e9edc8f50bbfaf091ff23706914901ce12069be5c3e8ede35e2d3fb82e0d4fc9e2a79e7
-
Filesize
53KB
MD59882bd760f9852913492780c5495e0ec
SHA17d041a04a5a537e15091a9165b60e8fb912b2223
SHA2568f7f4f32c7e5632ee1a41bed3d3d1c4acb79f8f5346daf3c7385924697f4761e
SHA5126ce9995b3110f73b61c8259a709e6fac746ed517bd8b997be045859b6be704f94c3ccfaaaf0887594da63a706b7604a6670ad348c017163b7bcd370e2f8ff411