Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
2e8cc55165c0977bff130b8af4d85d50N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2e8cc55165c0977bff130b8af4d85d50N.exe
Resource
win10v2004-20240802-en
General
-
Target
2e8cc55165c0977bff130b8af4d85d50N.exe
-
Size
46KB
-
MD5
2e8cc55165c0977bff130b8af4d85d50
-
SHA1
217e3397c52f07bc71b4e9d509014e2d49b6d344
-
SHA256
30bc8a53529e8fedb7bb2474981c436dd65542e6737c3876e30b3937bb287345
-
SHA512
c18c436b822a9666466cfce727b231eb61069feb3876c8c28cf4b52462dc5524b4f60b6a55935b71eee6f7838a49daea914ad893fb9879daef1c4d7934bb0e97
-
SSDEEP
768:W7BlphA7pARFbhM0Kkq81LOyq81LOl6Sl5loox4EOtiDJifox4EOtiDJi/Vox4ES:W7ZhA7pApM21LOA1LOl6o44424441tP
Malware Config
Signatures
-
Renames multiple (3280) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jre7\bin\jdwp.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp 2e8cc55165c0977bff130b8af4d85d50N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e8cc55165c0977bff130b8af4d85d50N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD50b706e1d36be166bc40b7de5cd954193
SHA13e61dcf4a79613e16ad771bd0ffb7ad71fd6d70f
SHA2569eb9bcc78f3914f34e19a5ea151493ddfc573367160679a1edc98be2500eb794
SHA512113ad515241214cd41aca6fb9160e06b8bc4dabcf87a2806e7498d5f5273dc9ed9757841ddfeeff2568ef414164aa6fcafb8e50134447b781baca8ff32b4440e
-
Filesize
55KB
MD5320f8608a0acdb9561bd4e7be8e71cb9
SHA1292c25cba758d01dfbae0aff0efd7f2781ecbe90
SHA256c4fcf4cdf0c99e3a9917b10aceee198c125f69ad705982db326df650fb913719
SHA512e385bd8a749780b0dbbfa2e4853e4bea2492ad293e224b9d69423f3ec2667ed7062db25b5730f12f7a918ffa16a33f793d114113208193a128d9c49832491fb7