Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/08/2024, 23:07
Behavioral task
behavioral1
Sample
c10d0c2bec9deaef4efcfc62f4d55620N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c10d0c2bec9deaef4efcfc62f4d55620N.exe
Resource
win10v2004-20240802-en
General
-
Target
c10d0c2bec9deaef4efcfc62f4d55620N.exe
-
Size
53KB
-
MD5
c10d0c2bec9deaef4efcfc62f4d55620
-
SHA1
76b3eeba6839cdb918c98fafb8482fa6d15811c2
-
SHA256
01b7807b874f4ef01469e75ceb40b9464c3361c04ea026d304f04ab72617d347
-
SHA512
97dbf06d99fbcd78003143b5194f384862f3aeac214c7ac1fcf8fb9e094f6bc23a6597d889f69048dc7c285d9331613b8734b3f09d5560851a995aaa55e2e36a
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIg:CTWn1++PJHJXA/OsIZfzc3/Q8IZTK
Malware Config
Signatures
-
Renames multiple (3251) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x000a000000012291-2.dat upx behavioral1/memory/1920-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/1920-76-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\bin\javaw.exe.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\7-Zip\7zG.exe.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\sound.properties.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp c10d0c2bec9deaef4efcfc62f4d55620N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c10d0c2bec9deaef4efcfc62f4d55620N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD51631e8652a2e00b21d16b9b879caf167
SHA1b5f40e44f9513584738380a80448ec7ecaf9afa3
SHA2567e6c9353515955671cdbbaa26b839179cbbc2d3d76204d2a9cc194c13beb194e
SHA512951498d17c9ce28ca3489702f275f0f19b53f0eadd5b560bfde2ccbc71046c8cc73ddc506057467b726986cb9beb0eb25a270d6866f0a344b2651d53cac38988
-
Filesize
62KB
MD516e38effd0627d2db2a3ca724546046f
SHA1d233a1778c04e60e166856dae63564a4e75e9d25
SHA256e76a1884d565248a346dbdd5a02bd390783193cb8a0dffe209f70ccf2612ead6
SHA512e236354a28cffa70d389241b0398e07e6e516a6fddcf110695e96cf4485cce778ac54e307e582973ed8d02c8ed108d500168d7b78eb4d60d747ef84910dec468