Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe
Resource
win10v2004-20240508-en
General
-
Target
36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe
-
Size
76KB
-
MD5
7f5617fbb5a7bdaf41972ab4fe135fdd
-
SHA1
78c96f9e9e6f7293d68e87817f4ff9519b9d7da2
-
SHA256
36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2
-
SHA512
7db4767394f483dc87f8ad4b1c3fd3da661d7bbf3624b85c1d6358d739b6c47991403f6cf3f9303ba3663378a474d5d6e22c447d17944242a5429f8c6ae943fb
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhA:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsR
Malware Config
Signatures
-
Renames multiple (3688) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\service.js.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\slideShow.css.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\service.js.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\currency.css.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\StartExit.raw.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\bin\jp2native.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Windows Defender\MSASCui.exe.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe File created C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp 36fb086c7bcb463e39d0aa3138394a103a17f54a498da859573456894cf172a2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5f7589d6a95e7f590c3d0a98dffccf2e4
SHA1d6576269de7b85467fbb9f145895697edadefe51
SHA256db1236eaf4612849f36bc19292459138b84e77178c99eac3f7a6e00bf5b629f9
SHA5123ac7bae0be5ef491607276b7d966d98b96f23f00929918b29565f05b14ce0a72f130d08fb685fd842f964bf493e3c8eb289ce9741b95ea0be946ad9c503fc64e
-
Filesize
85KB
MD5e225f81f3dce8185516a2c0c92cc438b
SHA10179d5390c804685fbd6314299aaa4b399c51931
SHA2567905e7dbaf80a4122b348469bb05fd189ab7bdd0ff7c96b0b90e351329b33318
SHA512c87b7df0cfe7103d2f78cedda80688394f704daf34a290fb2b67dfea8727bbd84c5b8bfb71b2b5f769c05b0910da145ebe40d610a297f1610e19b1c8e2530452