Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
5ea6525ec120d2492e81131c71fbf9a0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ea6525ec120d2492e81131c71fbf9a0N.exe
Resource
win10v2004-20240709-en
General
-
Target
5ea6525ec120d2492e81131c71fbf9a0N.exe
-
Size
38KB
-
MD5
5ea6525ec120d2492e81131c71fbf9a0
-
SHA1
713bd07ecf6ae51a5de33d05f2809e73a9a10a61
-
SHA256
fbb1f860c7b0ad5b7228875390c09aa580587eea76c05fba2fe7c0bb11c36041
-
SHA512
7a38c3017c4f57a00746b36abc001c2d46cba9457c387dd3be109351d287dd0511807142a83765747514d2b5298e6eb36e0162cc015dc3e6da20877fb523c055
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/FXtqAYa9tqAYaq:/7BlpQpARFbhTYajYaq
Malware Config
Signatures
-
Renames multiple (3228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\bin\jp2native.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp 5ea6525ec120d2492e81131c71fbf9a0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ea6525ec120d2492e81131c71fbf9a0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5dbe3d28f2f0b2885396882a3793760a0
SHA15eb70aafa10eb4df131e1088f389421a7287ebcc
SHA2564692a27328c271834456494605ce3d0856f3f6245ccefc0db5949dbe8df8245b
SHA512ba9a172dbd5a88056440a0614ffc709b6e8c37fa9f2d5906b1bbf6ee808a20286a5349eaa7d5fcd50853b305e9c669143bf636e3f5f2fe6c1d02a29d377bc549
-
Filesize
48KB
MD5da0b3ebb3280d81613c5f637f3c561fb
SHA1dcf0f088040f0accd20fcd301201056a17c365e1
SHA25601a72fe1ddb82f015f5d8d08e19751e83067e54e2158f7109a1e667d9947c250
SHA512fa1193fe29362899470f5299f9d3daca84056eb8a86acf8b1c6111bdc444cd4d7226f7f9dfa49062e6675679c47c005ac7b85e1468b8d1890432f498c29a76f9