Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
77s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 01:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
-
Size
326KB
-
MD5
2639ec5825ff4ff231b5c50cd50b9514
-
SHA1
9e13e135171f42bd466f26242b320763bbfcfba2
-
SHA256
3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545
-
SHA512
207f3fa4577326df71c21a5b871b2e4778c6486ca4f289495b8b391314b2c9fc507c883615870c3cd8c1fe832918f06e375ce16d04f213048312e7d70a8d5dda
-
SSDEEP
6144:PXqpsIPCYYNUBEP+abW67Dz4HFgnPOAzu0bD7P9YJJE:PqaIPbyUBWa5CPO0bPP9SJE
Score
10/10
Malware Config
Signatures
-
PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
-
Renames multiple (3466) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 12 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\N: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\P: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\S: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\U: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\V: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\W: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\B: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\Z: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\G: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\H: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\O: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\X: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\Y: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\A: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\K: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\L: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\R: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\E: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\M: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\Q: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\T: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened (read-only) \??\I: 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\MergeSet.ini 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\content-types.properties 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSV.DLL 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Belize 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\PREVIEW.GIF 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.ELM 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\SETUP.XML 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.ITS 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui 3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe"C:\Users\Admin\AppData\Local\Temp\3f943430b49481aca6f57051ed0ced1a08038373f063afdd2423d8d72b19b545.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
PID:1760
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:2552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5567f35c849b7a7a0a69a7f3cf61ac504
SHA1c9b4ac91f57de9afb6b9699fd45adcf145d2c3b7
SHA2567335d3e87a952bbb0e96e81abbdfa3c967713cc4a14e54f4d0881ce6b3e0cdbe
SHA51256358180bb625f9edc9b0c9c667fac94fdeb2293493b9d0c59e41a110169ba9f50951b0041380036b7fce6acfc51ab66890cafd205220f48395bc3d0222573bf