Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 02:03
Behavioral task
behavioral1
Sample
35073a9a81300f0091605e6d23485510N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
35073a9a81300f0091605e6d23485510N.exe
Resource
win10v2004-20240704-en
General
-
Target
35073a9a81300f0091605e6d23485510N.exe
-
Size
61KB
-
MD5
35073a9a81300f0091605e6d23485510
-
SHA1
a12e0d550b2f71fbd27492aeb91f801c5f501062
-
SHA256
182363421990d4fd5c6572a49b648e0f281af92b759b456aef4afcc634aa4eed
-
SHA512
3b8ee857700d321844166f3fe02612b412f06145c490ca9d083ddd765d443549bf215a6836e535f659782d99a485d9220e2dc50446c5b7bae84260a39fc00d63
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIV:CTWn1++PJHJXA/OsIZfzc3/Q8IZnYw
Malware Config
Signatures
-
Renames multiple (2745) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2292-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000e000000016859-2.dat upx behavioral1/files/0x0002000000010622-6.dat upx behavioral1/memory/2292-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp 35073a9a81300f0091605e6d23485510N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp 35073a9a81300f0091605e6d23485510N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35073a9a81300f0091605e6d23485510N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5851d5c4d1c51d3b572ff77b458800969
SHA102598816b361449a8340fdf579458c210626d11c
SHA25629f75b88e35111f2634c531b2c193dde8388a1c39e8a857659eae862ccba6a8a
SHA5124237b89fb08b62e3d82129401e307fee04de58be833416d3b98c9e666800db8fc15ba346697b47819ce204b81921c30f00098b587b6ab45651922955a944a32b
-
Filesize
70KB
MD5e27a7e4d8b5c6f121a26003fc1078d7a
SHA1551e4cc3c1a8ffe953593814843716264f8e891c
SHA256868915634e0a53015b7a836cd281819074b96c0ba648b78b2da9fa7e9f8b88a8
SHA512e9df63484a1914a8af04422d83397148d8375398d841edc888d0a9c181b7b5628d6e75bd8e68096dafe8efc99fa940d4a79b45f63df81f8049008d68b847ea5a