Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 02:30
Behavioral task
behavioral1
Sample
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
Resource
win10v2004-20240802-en
General
-
Target
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
-
Size
57KB
-
MD5
9e489e78a1f1616b6d60dfa94ff00ee8
-
SHA1
3966f5764b212c0f36a64a1ff95cdd324abdcda9
-
SHA256
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c
-
SHA512
7b632a8d396dccecf442347e82a38df8360f3fe9c2c07b78f41de2144fff6cb4782ad50afdfee550818a11cddc13b5e920d37f11a200816bde8ba1b611e7a02d
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rA:V7Zf/FAxTWtnc
Malware Config
Signatures
-
Renames multiple (3742) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00070000000120f9-2.dat upx behavioral1/files/0x0002000000010489-6.dat upx behavioral1/memory/2316-648-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\gadget.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\currency.css.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jre7\lib\jce.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\settings.css.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe"C:\Users\Admin\AppData\Local\Temp\beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5e9426045bb1ec094c1b1c8b4330e4517
SHA1a3b02fc3cb949a613df8b05dec401c1907334edd
SHA256915c1bf46274c926da26d42fa6811a99c0765317c0e492ad57a77d33d0238a28
SHA5128afb6b29084f3158c54b8f6f6b7dbe82c7cf50f68876cfcb6705729d67c293204cf0b8ddba547155a62305b516a44f2f9f669b32bf9c4f849987fbc0b3ca4dc7
-
Filesize
67KB
MD5fb73d37ce7919efa5723a8ddba0d9a97
SHA175d6f8a7041021b10fc86460e9c848e29a5de133
SHA2568a56a20307b72a4d7ae1a65bf18783e2592ba8eb7cb9c5ecb684f084872c7738
SHA512c077d1638ddf6a97ea8a4ad655de8317c55e59c6217bf6f66ffeffc99401834cfd8337831f6a9bcec91323e5f3918deb0a0ed0f40ac5dabe5df9672defb26379