Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe
Resource
win10v2004-20240802-en
General
-
Target
0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe
-
Size
198KB
-
MD5
ecb392115be62d9994b4bbc1d8412dea
-
SHA1
2cf640865c92733e64d615a6b13ef97b8a941715
-
SHA256
0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c
-
SHA512
94de20af5894c6656b57007fb62e21ddbc28feeafd2ea0396762eab229752b454f79e99a68aa739bd39cf798ea1463417dd1ee4ae639cb6adc71fc6425439b07
-
SSDEEP
768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qs9lRlCE:W7ZhA7pApaX0aX09rB
Malware Config
Signatures
-
Renames multiple (3270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Internet Explorer\iedvtool.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Mozilla Firefox\precomplete.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe"C:\Users\Admin\AppData\Local\Temp\0de881bcefca6fd9abc7e1580e86c46922723837f86cbd7f485046c64398fd9c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD59a124c9c3474fa0a2d022b108dc319fe
SHA1d3c8298604afb8e52c15725172fd6387f8ed00ba
SHA25658c2e0e872c9189c0a6c1e58a35b3170b30ec17281239e4eef2b8d3b17a64890
SHA51240b5334844a6b50bae9519dd21779631500dd2153b6c1b0fcbd6cda1866dbb2d4fcc70320a4ae92abdf5a57234a8850f845450b2766d9035edc9b0b9c8c12ce0
-
Filesize
207KB
MD533022ef1797ec047f16c7b05c602f40c
SHA1793e1be07408f1d396e92e8d002ca03baeab6299
SHA2564d82d6516eecefc91a77276617602da41bc43a076ed0533e60b00a5f8b374755
SHA51254b24eab3cea9fe706e69d677d0d8929b0ab2797d6d0b61070f410c6e8ad23e99f4b95803d47b55f95e7507b68b153f88a2ff3639172621cfaea6481beb7be2e