Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
24f34507b638bcc1a24d73627fd15e80N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
24f34507b638bcc1a24d73627fd15e80N.exe
Resource
win10v2004-20240802-en
General
-
Target
24f34507b638bcc1a24d73627fd15e80N.exe
-
Size
74KB
-
MD5
24f34507b638bcc1a24d73627fd15e80
-
SHA1
62f34a021d1bda89a49dab0566fa7caddaabc6d3
-
SHA256
db531b0dbd200a74128306c211f3e3a667a70a0763d7abf4e5a613eea4ee2e86
-
SHA512
7240d6729ce1a3a7644dcda6f3e108695ca1c399ff52bb13e5c395784943f6accb43463930c0154f52abc99e50de53608ac8f8b49063b15194ef0f4e7e3a6183
-
SSDEEP
768:W7BlphA7pARFbhvOsTKnKqtb4HBZjlwGpCYnigugqOzM9bdifwMtxEwJjlVku:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlV
Malware Config
Signatures
-
Renames multiple (2896) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\RevokeAssert.rle.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp 24f34507b638bcc1a24d73627fd15e80N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24f34507b638bcc1a24d73627fd15e80N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5fa05804d4867a634acb753c18c24e03d
SHA1cfd2346ad20a96dfa57244a0c3f0bde285ebfe71
SHA2568f49cd16950125248445a4ebbb3e54060f4fe2204389b7d1337e629a910b63c7
SHA512a85182f71229778e6313f29bc75e78484e741073a2d0ee190b3a24f748eb1109bbfce23494d98c21deb3128a7b6c9bbd64714cfe36de0e8a311e030cd8968385
-
Filesize
83KB
MD570fc3d5ef029c4be6633b3fac87e7ccc
SHA18f276c705a441b28ceeb2e3fe832ef628773b77c
SHA2562bb607ee3ef508273df645153970dcc4073dfcf143e8da110bee4f04ca87833a
SHA512828f6234e5caad1ae75b8684d96750b60cae631fcd471b48c2599e9ffb219d47c4ebc1f242f67159a3f1d38ec6206e67bab1564aaacacff44430d20938fd322d