Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/08/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe
Resource
win10v2004-20240802-en
General
-
Target
bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe
-
Size
93KB
-
MD5
c1b89eea3684fcfe040c9be9d0c16eaf
-
SHA1
a8a91808ca8acd485326ca03d0caf9357c6ac098
-
SHA256
bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0
-
SHA512
cf44e168bd803f793bb60d984f2cbc177a00564d8872e0f8dac0b423d8f41b18958d23158e269db4509b2ede86d1462482e518821c4f3fac0ddffdec8d93b10e
-
SSDEEP
1536:W7ZDpApYbWjIoPyPoLzV7c6ShZQ4PN54PNPw:6DWp4Wy
Malware Config
Signatures
-
Renames multiple (3500) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jre7\lib\jsse.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jre7\bin\sunec.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnetwk.exe.mui.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.mui.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\settings.css.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe"C:\Users\Admin\AppData\Local\Temp\bd5858856ae20a93a6d25277a7b987afde7f24f744a649489175171530db5be0.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD522ce91de9d1c39c48bbdfd5d2e4ec628
SHA16adb08f732855ad3b516569563364fe7a6bf7d7d
SHA25650b86f39a9bcf2d37dc17bdde7a4accf0c1632b9544f8ac863c0d2a40cf2e940
SHA5120d7c2f6cbfced596afb42f19b9d9239f04b6190c176e03715eb29226aead1c1dd549672678f1552b73e904cfaa9658094be1c451eca74349a91c8b93423767dd
-
Filesize
103KB
MD5cd6bd2f9e3ebb23c273349c116855279
SHA1527e4dc7c642123b39a8a383442bd2b6a485f55e
SHA2566371921c4739467a3c0cfc34807e027c875269ba80b9828ce5e3670cf387e17d
SHA5121974c85d59eed082ee37257c27da8e943084681b7909dde393864f60b2c597a39362155e46398db875122c666753c6170805dc602d67009f6b77dd89f05cd125