Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 17:31
Behavioral task
behavioral1
Sample
3769142aa92878b2dd287315feec9ab0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3769142aa92878b2dd287315feec9ab0N.exe
Resource
win10v2004-20240709-en
General
-
Target
3769142aa92878b2dd287315feec9ab0N.exe
-
Size
22KB
-
MD5
3769142aa92878b2dd287315feec9ab0
-
SHA1
f37900a834f9b42e442a5f7af8063859f10fdd80
-
SHA256
c079b36dc070e1ecf426343a163ff8dff147acb24bc112a1f4c5403770d95125
-
SHA512
cf45d86bf714522390fc42b1d59263a20d313620447b7af273e88e86dd5f3eece89f1cc3d6ce275cf21830c549cd5e1af20071eed4635f109c6bbfc2d0fa39c7
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lzwAI:kBT37CPKKdJJTU3U2lz4
Malware Config
Signatures
-
Renames multiple (3187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2760-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00090000000120f9-2.dat upx behavioral1/files/0x000f00000001045a-6.dat upx behavioral1/memory/2760-76-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp 3769142aa92878b2dd287315feec9ab0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3769142aa92878b2dd287315feec9ab0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD50674badda6506e18597e2eea70a04b9f
SHA14574ddb27ae26fd1d6becb6e6b3f6e172ea89859
SHA2565446ae7380b3a86540438bdcfbcdaa4ac3a59c9a2008a3abda99871ce6d7b072
SHA5121412b5474a3c0c91e4f481d98e63b5677f96dfca3ca02bc5f7047e7d2a4d0f78dcd12fa8602240bc5d93f3106656e3458f310e5cef50442b52b2415864803a34
-
Filesize
32KB
MD53fcb7ec306a37ec62ee26c7a128cd5bb
SHA1100aa03c81cdd728abaa42fbe6e40998ca767aa3
SHA25641111bbfca7af0ce7148a783745a02c54eebd3e5e38cd82ea3de49811bd5cc6f
SHA5126d0e3e1e0d6800d1d88ec6836b5f87b07a04e86e61725fe81ca4d80540d07f6d5643f28a7e98eb8ef1ae24b15fe1101b0d9ba42791492314d64d536f6398d84c