Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe
Resource
win10v2004-20240709-en
General
-
Target
2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe
-
Size
36KB
-
MD5
c05b73c7c2db231b49586d8d255a8ffe
-
SHA1
f3ae3054419cdd2cc4a859f63f2881600a89820f
-
SHA256
2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae
-
SHA512
c10423b7de52a9d98742b3606a24aa11f1d604cf2f18d80cbe485a9eb5c5c13eda3256bd639eb831601d8d2e1c9a0876c047b70816d2913b65ecfaa8f846b480
-
SSDEEP
192:tACUADIY0Br5xjL/nassAgAQmP1oynLb22vyBX5HAug4j4fPUDN5HAug4j4fPUD1:GBt7Br5xjLvassAgA71FbhvYD/DMG
Malware Config
Signatures
-
Renames multiple (2276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\7z.dll.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe"C:\Users\Admin\AppData\Local\Temp\2e3111a1dba86adf96265e1f7cc4327c3ce080b7ca04e7c68bf49b6a84e34eae.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD58c6f331d7e2b58d22f1da004066c2508
SHA1d6c7a590b5041eec2798a3796295582fc534a82a
SHA25694d3ebbacecf6a812f9d9a12833927177e14be7607240c595514c8e3442f41a4
SHA5127f7c3c845cfebd5ef076f551a458b02cad635a63f4006e23fd397cbbffd9dbfa0c54003018a096c36e7d893fe400014ab9c26b2b4d32ea19fd241edc67a0d8a8
-
Filesize
45KB
MD5ca7dbc4b7c3db6f0da0afc2150e4d6e9
SHA1486588de8c17252f03622803804ea1191e1fc008
SHA25675346e5c5c13fe32f8f20c4e3d54a5a97d7024d48472dd4a067974e0c9e6f67e
SHA512e0d4e490f83b5348baea903e7d80f95871e71116d0eaab7b4eb0e36d12f7c2f1eec4cb41f51e8655cb5a4755f8808ca4ef5019e49e1800a4aacdf6fea55c1c35