Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 00:02
Behavioral task
behavioral1
Sample
191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
Resource
win10v2004-20240709-en
General
-
Target
191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
-
Size
99KB
-
MD5
191c0f94443e9c74f8e2b4e78dcf4dd0
-
SHA1
05b7e2be0e8baa364b3aec2b48aff7ebf662d06c
-
SHA256
cff021ccf38040b2fd04ec6171b8921ff4d5719cd3573b2af5da0db86b3aff70
-
SHA512
bfb350ce2ce36a9da8f3253133c1ecb797accce3e94e3f885ba2f013aea5b7d2a53ece49af5817028ce6916d58b5a29bd99472bac953678fc8d939c9fed580c8
-
SSDEEP
1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulF6m:enaym3AIuZAIuyxJrQul9
Malware Config
Signatures
-
Renames multiple (2841) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1908-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00090000000120fa-2.dat upx behavioral1/files/0x0002000000010486-6.dat upx behavioral1/memory/1908-642-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Mozilla Firefox\updater.ini.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\charsets.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\security\cacerts.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Common Files\System\DirectDB.dll.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\Mozilla Firefox\update-settings.ini.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5c50826bf5afd551fc11c4b9c59c74254
SHA1a77776407e2ec1df8ac901f7ba80ed52ea581752
SHA2567f833c6235ac13283a6847b7f8b4da293b723afbfad050a777d46b468e36441c
SHA5122676650cec4d28293db84f0ed75aad50c9b3b44824a6107adff68e2684e968813f378e91bd417b365503fb7ec01133e3369458267ffed560ab0b073d543eca26
-
Filesize
108KB
MD56aaa56928791863cacb7760b7743df14
SHA1cbe9a1d4fcb3e95a39e5199757c94869d326876c
SHA25639893736993cd0c77e63d4928d93eb8c44c208e722553f9c6850fe030996e4b7
SHA512f365dca03828547c1792330f425f974f340ad32471aa332ed4e7cd1f6377c25f109acef17d7dd5f5d9cb8ee7b872287046aecd19bc8ed01d63d50eb8f5d8920b