Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 14:53
Static task
static1
Behavioral task
behavioral1
Sample
9afd6808c05514f158a9ca78d653a150N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9afd6808c05514f158a9ca78d653a150N.exe
Resource
win10v2004-20240802-en
General
-
Target
9afd6808c05514f158a9ca78d653a150N.exe
-
Size
50KB
-
MD5
9afd6808c05514f158a9ca78d653a150
-
SHA1
7ce5b5b91b49d22008a38ba576c19ba52e538807
-
SHA256
8336166f39a76ddf04182b003b78955047b80d5e17d105379fa4022c8db1b42e
-
SHA512
2e5eed177ee2ca8582d35c65f297b1864eca044bf5399ada8bc093aed31611f5884f30865698e6fc160a8e8c8f790cda164dd11500c1644be7de8107798f71b2
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyfxAkJhxAkJ/1PQurQmi1x7urQmi1xY:W7ZppApyVyjVyUosPosk
Malware Config
Signatures
-
Renames multiple (3140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jre7\bin\klist.exe.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Internet Explorer\perfcore.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp 9afd6808c05514f158a9ca78d653a150N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9afd6808c05514f158a9ca78d653a150N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD53519cb34361eeabd5675d7cb74b98184
SHA1aa9077675611a4939e88854f4a69fdb389a701f5
SHA25690a78e836405912e695414e5e86f666390fa85f8f2502afc64d171614ee4072e
SHA5120d517d4ff4134d9e98bd037352be71596f10d4e834e425862097d76b47b064e1ca0fe03fbf6447d0ce91acb924a93f257618f62aacd15279747999b7b832b354
-
Filesize
59KB
MD51820afec320e94df594dcc2a549c25e7
SHA117c4da69711dca9fbfb3744c418ae358a34ff85f
SHA256aff45426a7c32936957d17d12ee41c65f1a3c946e1da2b89ec405036b3362c2d
SHA512a16a102afe4a1af50d98b1385fc01555b6b63da1647c52ba4990da443df5f0fd8ea71336ef1b45bbe6c9895473c58da22abc82fc771ef1538ae925761b314e48