Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 00:04
Behavioral task
behavioral1
Sample
c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
Resource
win10v2004-20240802-en
General
-
Target
c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
-
Size
53KB
-
MD5
8f518899e6b3df25a63905615c9fe59c
-
SHA1
ef8556b144861963f35f4bad2de85a4e8a938b90
-
SHA256
c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946
-
SHA512
429900d16a979f139c370c3fc98ef8f6b498e2729ceb774dc069a84647d337aadbd5f7ea07576ca3d9d8fc2be49146d14c0c6d69a8342c6ee0c8048a3d594656
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJBZBZaOAOIB3jM2jMHsLzwze:V7Zf/FAxTWoJJB7LD2I2IHsLMq
Malware Config
Signatures
-
Renames multiple (3872) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2504-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00080000000120f4-2.dat upx behavioral1/files/0x0002000000010489-6.dat upx behavioral1/memory/2504-668-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows NT\TableTextService\de-DE\TableTextService.dll.mui.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jre7\bin\libxml2.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\Java\jre7\bin\java.exe.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.tmp c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe"C:\Users\Admin\AppData\Local\Temp\c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5746c3ac064833797ae196512083cc665
SHA1311c6767cf55a752d1c0c3ba052ef835984a6d2f
SHA256f4717845cc2870434ef9f066a3f7e3355ac42cf1a328bc3e561a9d1ea0265abf
SHA512aac33e9d7cd430e3e8dfbbf847b72787b88550c329cd79ddd1e0f5196c83fbdcaca9db56ef401b86420b7e7036b596e61d7314fd0b17569af988ed55bf90bfa3
-
Filesize
63KB
MD552f27da54f38360841286f270b320271
SHA13f2fd8bad79e04b88045dbe78fcd0cdfc6d0ae5e
SHA256453d8aaea2bd21c3012ad9081315b5746bbab54d65b62b41bb00036b54402656
SHA5124aa4ade2a70868ccd0d32208046637eba1563d6770bb618a965481dfe5661593ea53112de1df53daee38733fc708a894b8e50a6ded85046c6191a71556ec18e4