Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe
Resource
win10v2004-20240802-en
General
-
Target
8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe
-
Size
195KB
-
MD5
ddc7c7b6cf88fdf9727e29bef841e694
-
SHA1
2936b6d8643df8eee5b7dfd7798114f2b144d4f0
-
SHA256
8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade
-
SHA512
f63f92e487f25e6483a0e76f6842a5a2286ff05f15cbd2bad573524ae7bd99a3e212ef15b0854fd0e8a862719fdedab0d4f0bd3bf206c518d11885451316f0d7
-
SSDEEP
3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBJTzkf:RqKB+tOkWKR0iJ0lTzkf
Malware Config
Signatures
-
Renames multiple (3249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Mozilla Firefox\locale.ini.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\security\blacklist.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\DVD Maker\PipeTran.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jre7\lib\deploy.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe"C:\Users\Admin\AppData\Local\Temp\8e4b379e28a03c85d06c34cd2f0c018f9258f113a31108d6ed76b877966a8ade.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195KB
MD51595adf37a96638d1709cfa3cb500679
SHA1d798670375a06c23db8328badcd8c8f9ec742807
SHA2560986c66ed0571dc1fb870d9b6084f5f62a38f5f43d4240257f8ced446465fbe2
SHA512aec4a2d6a731425484048ba425fb9d42299120fb69527e836a89420bd201a3655208637418acac43d783e1fc74e882f3a3b0859190bed0beff7d415a43f55c63
-
Filesize
204KB
MD531b4845b0dbf82a38f013250a9b284fe
SHA162f54b6cb5130f5d54f0a29d6836b4f298b2c3e4
SHA2562cae80a23ce6c17dcae54634b6044ee55f27145a4972aa2dc0bf30e204edcfbf
SHA5121226acac494b152024d734ee8be91f123281503a1a5d736166b98fab5497fc762fcc3193c9e06b643b319b792e3b1935d57828a3f0f7cd1e58d3daa9d23591fa