Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/08/2024, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
Resource
win10v2004-20240802-en
General
-
Target
61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
-
Size
58KB
-
MD5
dc6bfefbcc6695aabbc05a0723c9df36
-
SHA1
21d1212faee145ba147171ee5b15707b534ad30c
-
SHA256
61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31
-
SHA512
8e945c7a5eab7e45d5936e3909ef5816f9c8f42ed99ea8c7570d085bfca36fc3d2bcb293ab0cfd2f3cfb0ffdfd1aa621fb0e7dbf47db2041fa0963b6bb5f540a
-
SSDEEP
768:/7BlpQpARFbhq1KX101je2/Qdme2/QdAe2/QdDe2/Qdme2/QdAe2/Qdqx:/7ZQpApq10
Malware Config
Signatures
-
Renames multiple (3675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\VideoLAN\VLC\uninstall.log.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe"C:\Users\Admin\AppData\Local\Temp\61495835f77d1b8a3f1e54b233900a154d5efa191f02f0f5cc6dd3cc74c2dc31.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5e540e41c2126d24d69fcedd214010d5c
SHA1a40882ded5004e70191c218fac1a5c53b00d520c
SHA25654af124cf08b2679878022991d12e95918416cf9520234252acd9c1aeb1bd2b6
SHA5127c539ff50354e6c554d329e90cdb2e8a9f2949abed34f25eb40551d2aa14768bb2da26df5bbf8a87357a181695d7f323548117de839c506d46bb3a48f2df019a
-
Filesize
67KB
MD544fb576b1c06b246e510cafbc5437ddb
SHA1ed00ccc3748465467ba608384b813c74b40aa467
SHA2561235f14223a3a5fc5950c2c9d2da51a9697dce1b8647e413e41b7ae1142cd7db
SHA512004b24884f8cf134d593fd77a622627269fdbeb785ae4eda243aeb74024f82b47b1bec3faf69fffbec5580897ea02b5df286ad603e1d62a606ebe58a4c629c2a