Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 20:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
-
Size
34KB
-
MD5
b55b75c93602efb09d483d83cab530ae
-
SHA1
a37927d9480d264e1c80532d0b534cbfc0bb0ab4
-
SHA256
3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f
-
SHA512
70e5e7485f2c6acbea24659872ba3df0acd2070a66564d1ac435af31d6a497803eb962acef96e6866cd90a9ac81a99c070ae663b18c3c2a6e0d28f3abca17e5b
-
SSDEEP
192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vB7m/FJHo7m/FJHhpq5vf:yBs7Br5xjL8AgA71FbhvsKvf
Score
9/10
Malware Config
Signatures
-
Renames multiple (4119) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\skins\skin.catalog.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Common Files\System\ado\msado25.tlb.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_EN.LEX.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\SKY.ELM.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_dot.png.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFPrevHndlr.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEERR.DLL.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\timeZones.js.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe"C:\Users\Admin\AppData\Local\Temp\3cc495ba124ef189639f07e235037863d898bb20366dea03ae6b9e5e07f45e0f.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD575c0c5287863db2949d3571366c587e5
SHA1423846fca7f395b9e58308fb3de6ae39164bb4c9
SHA25605613c1f78bb3a983d850fa330a29b47a79645b8fdfafbedd25523522b82606c
SHA5122e60085b9fabe9e25e63d8699744690e12c3be113c65968f9905d78ce5893afae5fd27120848c4ece9ffbfc7854e9d58b6309e4df3b0aff54d4df264b80489ab
-
Filesize
44KB
MD5d71e017048c37329d07bbbb902fed1dd
SHA1019fef5009be8354ef9318a3591318e1648d4eb6
SHA256955ae3a1bffe672414da20d225f90f63ad7327072bbcb94313ed4737413c8f1e
SHA512358d141a1ba019b919d46e4d389931a9c8c714d429fa197ed7862bbc9d7905e50976c9ab0721458bfb006d43a24ebe97b329bdcdfde4a8549088ad5d7a739bf8