Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 06:07
Behavioral task
behavioral1
Sample
56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe
Resource
win10v2004-20240704-en
General
-
Target
56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe
-
Size
137KB
-
MD5
56d4a9cc5a98d0979a02a4ceefe7f4e0
-
SHA1
643c2107d05059a92590b9f64cf60edba8ea68da
-
SHA256
24418d759f6d461e0321e9dbc59c2169aeb0b116e7695c11210ced32bbcd1733
-
SHA512
bfb0acc836876262a2478099353e80d6f9084e51d29f5912b76ff2c5d909eac6fbaff68838e481491ed550c8f1341f5098cad5e16ce8bba4544537033258ec58
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2ItTWn1++PJHJXA/OsIZfzK:fnyiQSoDuXuv3JQSoDuXuv3dwL
Malware Config
Signatures
-
Renames multiple (2764) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000f000000011b9c-2.dat upx behavioral1/files/0x0002000000010667-6.dat upx behavioral1/memory/2528-538-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\directshowtap.ax.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\FormatEnter.reg.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\CompareUnlock.mp4v.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\ExitMeasure.xps.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56d4a9cc5a98d0979a02a4ceefe7f4e0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5cc95f3c4d5877acf99e757f250eb50f0
SHA14f847aa413bbe56953569ab037059c43b826ade1
SHA256f85b9977c7103a01fbf577a3a7773d4c7daa25eb631234cd4e15bfbb940e55c2
SHA512d1b4ca21a19efa78c63c43a32dbd506a4e067d3b896fd00880c6654ea0c5cc22b769bbbd5c806a0c4cf5c6bd862993aec0297d653e5a2ad17fc2edcea1985c03
-
Filesize
146KB
MD55360bb1e155dc99e4dffb56d206ad057
SHA1c394f52923608df9d427974b78241c2b5b4cb2d0
SHA2566da42ceb3791f79ab2c4547e010a64a2ccf519e6145b3d1185322a8cbe79b613
SHA51215cc8ce9350f1a744359b99472e1592225ccadbe410d3a9ec8dc259831aeb8ed7f29630550df683299cf7d122d7e6612fabafd834db6d423d5c21f98d65926ba