Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 21:40
Static task
static1
Behavioral task
behavioral1
Sample
0fa8974089fe15ae4a6528e814b7cca0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0fa8974089fe15ae4a6528e814b7cca0N.exe
Resource
win10v2004-20240709-en
General
-
Target
0fa8974089fe15ae4a6528e814b7cca0N.exe
-
Size
39KB
-
MD5
0fa8974089fe15ae4a6528e814b7cca0
-
SHA1
197579d7060de3de319ea859983c2b582276b3f3
-
SHA256
6b44412f4372f8a782cbd1a5f86c8304a00909de0e447a623aacde9dfb0c45c6
-
SHA512
188a5f499ffea0fbb5f7e784270bf82ce03c136f799c6bd304b61c0ab65993470ac36b2cb5178ece21b110d4a15b1aa930f30ac4c62668f0c122d82d5f68dd70
-
SSDEEP
768:W7BlpppARFbhjbhQYjY+WyKoIWbsHfySkT5GeQbyi348oWc1RPOzkjId6q8UdrSn:W7ZppApBMyKoIWbsHfySkT5GeCyi348Y
Malware Config
Signatures
-
Renames multiple (3229) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\plugin.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\README.txt.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll.tmp 0fa8974089fe15ae4a6528e814b7cca0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0fa8974089fe15ae4a6528e814b7cca0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD53f1f1cc44d7f41a28e2bd63284de05f2
SHA187fad2395d0d5723e37fe017e5cff39c7cf1b4ae
SHA25621e93d969c3d5dbcd5b3dcc36a1e6868e4ee9746ff486a2b9b40c2fe96540932
SHA51203bfb2583a1c3b2603cb08a4bcfb830416e6d145a60784d8a019e14050c467d712ed646c0b7b0783a9a069e21a354aa73ab3f9dc9eb35354addc9ec107f26d08
-
Filesize
48KB
MD5576c1e6e896a5b9d55d3e4a366338f49
SHA1a9fa21c138f9eadc96bb57c52d923e93882f2d29
SHA25628c1fc0b1a398e7b1c28c617eb6bbcb496976884673f2fbc32d7b93e8897e6a9
SHA512e234a676c220e5ae0533fb80658d33a9a12483d16193efbcf8ceeca36ba112ffe343cdf12b020f301b3b8b8b2f23045bb262f1e722962b55a5446323d5d67929