Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 17:29
Behavioral task
behavioral1
Sample
37437f0f793ecb09ab51a7ac94e81dd0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
37437f0f793ecb09ab51a7ac94e81dd0N.exe
Resource
win10v2004-20240709-en
General
-
Target
37437f0f793ecb09ab51a7ac94e81dd0N.exe
-
Size
42KB
-
MD5
37437f0f793ecb09ab51a7ac94e81dd0
-
SHA1
29105f2cc798cec6a528d58687045ba29253654a
-
SHA256
d06a368a115c4d7cf0fc50a4d1e01eccc29040ac471aa9a79ee8c91c862f6a09
-
SHA512
8b0489af4f6e7e7c0b77b5122c2dd43acbef6f1fd139346f39f6ec8d18a672fbaaa20d5491d652205919dd38d5ec90a05ac9c4f11e237bdcc2583020cafa2a32
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJXGiXZBGrG6:V7Zf/FAxTWoJJXS
Malware Config
Signatures
-
Renames multiple (2863) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00090000000120fa-2.dat upx behavioral1/files/0x0002000000010486-6.dat upx behavioral1/memory/1712-574-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\SearchConnect.sql.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\OmdBase.dll.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jre7\lib\security\java.policy.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp 37437f0f793ecb09ab51a7ac94e81dd0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37437f0f793ecb09ab51a7ac94e81dd0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD52adb00d70c7b9ffd286108dc273df1bb
SHA12dea32f8825fd5687171d5aa489b31fc2da46e2a
SHA2560db0e6ed9162fcd481b414abc4c3becb6ded9699d506622833dfa0b30712899b
SHA51205791a78a3353ca7b056f59843f6d7f6e7c04c591ba21b492cfb98a846f1ed3ec5549a5ab6a576b72881c9ef6a837c7c7c26060cf7dd7798e2892ef83f69e7f9
-
Filesize
51KB
MD540e084ce8673317cb88e6c6509f4fab2
SHA170914f80e5ce820c70bcc5048b80899064ff98d6
SHA256eb7f81ff79bb29089e6feace01ce9de1d6de4ff936dae4872469b0d304035c43
SHA5124a75f615df5c341ca362e827dae749e6bc017ea4bc5b4a4c62f36eecfc35e121a6b3cc8f361bfb5f6902fcba6ffad7e1ea954f32147527c695d7d270d56850f8