Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
4846d725e9ba2ea99b57a5fd44698f70N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4846d725e9ba2ea99b57a5fd44698f70N.exe
Resource
win10v2004-20240802-en
General
-
Target
4846d725e9ba2ea99b57a5fd44698f70N.exe
-
Size
45KB
-
MD5
4846d725e9ba2ea99b57a5fd44698f70
-
SHA1
3e9d93a9f60543108baa4859fe449eef68230d64
-
SHA256
53d72e62f62b955e1f8d9521991b4a48882abbe480bc6d7ac2e908fd47a2404f
-
SHA512
05e269be5f147cf6dd0a147faed6f309c697faeaed8248350164dc80ce721f4362285ab7a90bafd3c4dc05ea7b0b6511e36f3f736c6e6d2520b23e4bd18feb8b
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJL6zW:W7ZppApBULcfpHLcfpyDO
Malware Config
Signatures
-
Renames multiple (3422) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\release.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp 4846d725e9ba2ea99b57a5fd44698f70N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4846d725e9ba2ea99b57a5fd44698f70N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD505c4bd6f52efa54d605dffa78f62efaa
SHA1b1ba4105740649140f2b46ebdd07dc7a0d97d775
SHA256ee0dfe62856e4105c433a9b3c5448622c5bc008bb20f181bdd1b5e9cbf50c051
SHA5125b8b76976974cdeb3ab393fbe0ed2ebd90f5843f8d577c35a409247feac6b55a2e546229e65ac5e8b0273ef1f4b3a3b33b5f51ea508263439b73ab88dac56bd7
-
Filesize
54KB
MD5b7f9edfb278c550b33d44c6ef9857e42
SHA104a7190e470163025a26ed51f2090264c56f2c5d
SHA256dfa9fee6db0b4d54ecc26a572b5b61cc73efc3515bc1628460cbfbe5877ca70f
SHA51237b131421969c233b40d66ffdb6a62102d3edd5e66081802e615edf601de17f83aea066a372014568702afc4929848eef0dda01ef61fbb4ea78c212fd0504490