Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
16b45b45007bee220d4d10bdb2c4c970N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
16b45b45007bee220d4d10bdb2c4c970N.exe
Resource
win10v2004-20240802-en
General
-
Target
16b45b45007bee220d4d10bdb2c4c970N.exe
-
Size
45KB
-
MD5
16b45b45007bee220d4d10bdb2c4c970
-
SHA1
9b7869b9a8de788645ee446687d205db92755273
-
SHA256
30c724831ca9c4afff131a7c400546036a51b5eeb5b7b2c445e259ffc424f581
-
SHA512
40fa6a5dcddc107c471df51d0c0f6931ba933dd5645ce0b7a1f37d6d14286ef1773a9cea132437bcd7e33c31c6e9885eecbeed01a6e972463856dbe7e6df4520
-
SSDEEP
384:GBt7Br5xjL9A7AgA71Fbhvnqj7jU7ubTAgpbuvx10AaIdKB7ubTAgpbuvx10AaI7:W7BlphA7pARFbhL801VvM801Vvv7GqS+
Malware Config
Signatures
-
Renames multiple (3212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\ExitPublish.eps.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp 16b45b45007bee220d4d10bdb2c4c970N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16b45b45007bee220d4d10bdb2c4c970N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5b0147ddb59596b2b5fd7742c61f5cde1
SHA14d0c8fd57f6e9857a99cee018b91a42911d5beac
SHA256745010706378d6adee318af5d23b8a01b8ea74746efd87aabea9e5a618c68074
SHA512c409bbf63f38b012f54ff74032e7db16c5213b4d467cc9897f81c84032087fbff8d306aab2b0a51636176291e8796c31fecc7888b05993a7f1768317e5f37c51
-
Filesize
54KB
MD590f96fc2d7d5fdcc4922c1ed4c4309ac
SHA195d794778c99519cf9bb62917540362c1120f3c6
SHA2560cbf42dfc2bb18667a324b96645613295f1f4e6c6795fe9881817ebbf0f40040
SHA51214d2dbb68379b28b6c6ca845f2aa8f37bedf7f185bb35e1ffc3e5c461f2d809031d41bc0e6ea685330fb0bfeb3e828e869c34da6e7f04a3b28ccc5a55a20f6b2