Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
213c852ea6d6614a4e0916dcda3331c0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
213c852ea6d6614a4e0916dcda3331c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
213c852ea6d6614a4e0916dcda3331c0N.exe
-
Size
77KB
-
MD5
213c852ea6d6614a4e0916dcda3331c0
-
SHA1
89e08e46de4a939c7fb44887a2c479e360bcba5c
-
SHA256
ec32f8fd9bc1a73d77291bdb2b41d11eb017fe859c0a7d555c3105a530c54fe5
-
SHA512
42a880e47304771392a6fa390f17871ea5997f63ecdc4cba7d9003f3cfd228a061017a4079e922ae7cc708a07a9d8fc3891804206370094586d0adfc0304a6a8
-
SSDEEP
1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZv1+CdwEbdwEf:6NLWpCZIzjwHwt
Malware Config
Signatures
-
Renames multiple (3114) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\ImportMove.odt.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\HST.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\bin\hprof.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 213c852ea6d6614a4e0916dcda3331c0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 213c852ea6d6614a4e0916dcda3331c0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD599f9285765d5194da84de724510e9561
SHA131706ee120202e694653e9b66767e4a7de0c1ad7
SHA256a385ab3a43efb0ba2adcb1d496c391332532794e3e3d905ee7f3f447196deca6
SHA512b50f1ba2b998043aa2ffeac0564a30a8a10f705319ce4108c9f99245a947d1b3f3de55580b0c9676bf973d0567aa5b6c7d32c5dbe15bcc01ada9dfc350a44d43
-
Filesize
86KB
MD5a56e59771c143b7e81c0c328c0c20898
SHA128c9a9fd5484d4bdf31c2815afbd0184bbc05484
SHA256a842e1dec6ec4daed106b8e8dbc8931e86fac274d48def4f695e44790b2dd673
SHA5125c3705a4a5565b159b6251dc4093c1857fb00fd14220a4c95f1605f6cbc2de57a7109c22296df9f21ce31669ccfb81297c7a93eab7ac1c93eb6074735f01bbf0