Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
deac4a0c58de0b9eff4426be6b67b440N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
deac4a0c58de0b9eff4426be6b67b440N.exe
Resource
win10v2004-20240802-en
General
-
Target
deac4a0c58de0b9eff4426be6b67b440N.exe
-
Size
96KB
-
MD5
deac4a0c58de0b9eff4426be6b67b440
-
SHA1
32fed6c408f86c8a72d15bb1c248da5108b387ca
-
SHA256
2c121dc45cb811c7e66e773ba65194a241d02ec69349e78a5a5545860a64447d
-
SHA512
d99b34b77928424412edfd6b270cbdbed47627ef1c2f6f08d2fb0eff59a79c808c46a1ceef608f08ae029953b9317c6970ad481168184705acb89bb0ed123e9a
-
SSDEEP
3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9iH:RqlIyFESWu0SWu86jYH
Malware Config
Signatures
-
Renames multiple (2893) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\javafx.properties.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\bin\libxslt.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp deac4a0c58de0b9eff4426be6b67b440N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp deac4a0c58de0b9eff4426be6b67b440N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deac4a0c58de0b9eff4426be6b67b440N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD55d3905b3f852eb567cfdad32a3a1e25d
SHA1deed0c2f721fc3a4912c5c334ee2913173ea70d3
SHA256ca5d3427c02592e11d7f0a370494974a3af41151f044b103e9b42ea07f289950
SHA512200689a4043cec0d86ca59d78339c500ec0d76c0314ac2d32b1d2c535b5bc3de69bc2c24bc63f8c5b71fe1b1868093077165d794b97c1cfd2d9e2c5187963358
-
Filesize
105KB
MD5bb7b6944c0c59e3b700f7da121246937
SHA139181fd2f9554d9879858b1e6cad16c83776946e
SHA256b082c5890a2aba4fee65899d1ce3e42c4fc13743ab33272f5b91ef269928264f
SHA512059fab4261a521d99fa573548dd82466adf3eb71a1550306e9224045b0d49355c761986fb6c8651327874c35fe61da409d65f30283e528caaeff233d72061988