Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 21:25
Static task
static1
Behavioral task
behavioral1
Sample
530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe
Resource
win10v2004-20240802-en
General
-
Target
530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe
-
Size
58KB
-
MD5
c77202ccfb27f9f21976521f19f09fd2
-
SHA1
4504de40346cc111292744be84872d9849d99fd8
-
SHA256
530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7
-
SHA512
84ea538acf621534c6dae59419273ae008630ea64503c3f45132a35dbc639366b9621b8422dd30126d69a8a0d79874d45af19071e0ca1794cc84f21d1b2ab9ab
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0cEMdV8IEMdV85/K1p:W7ZppApBULcfpHLcfpX2/Nw/NwmxP
Malware Config
Signatures
-
Renames multiple (3792) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jre7\lib\sound.properties.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jre7\bin\ssv.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACETXT.DLL.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\DVD Maker\Pipeline.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Mozilla Firefox\softokn3.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html.tmp 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe"C:\Users\Admin\AppData\Local\Temp\530c4de1f774d4f9e9821d51a36226efb42abc8f5047a5a4d55e742d1d7e76e7.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD59f0ecb248156a59ea1c1edb8331ee6de
SHA1391273678002642417a6dfbb3d4f770aec257de8
SHA256330f1d367a0757edddb520b9f61e5ce88b85e4999177ba8503645baa0d0d40be
SHA5124656323ab34fb5311056abdf5f432c010c07b57a11bc0e6762399d618e21be71593f74d9591d68e11190da5131e393d571a7d424cc1220e10a64b5a46fa527dd
-
Filesize
67KB
MD59c59e8531fe7a94c39654086a5c7c533
SHA1f044ae06110c2abc074996d0018eeb3e7f60326a
SHA2565c29fb0a4a89cd476254113e8701916d77616f0e527adfb093007b3260468f54
SHA512546d53cc0d1d9a0f1f23a0a412cae914d23fb5c7d8a69ac8360f72a3a720a88c3cc3fdae8ac41ed3fd65e0d57d215afac819d431370f0810d5fc18fabfe6b624