Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 07:07
Behavioral task
behavioral1
Sample
f47ea9b4133d59f3384b2ded02f4afc0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
f47ea9b4133d59f3384b2ded02f4afc0N.exe
Resource
win10v2004-20240802-en
General
-
Target
f47ea9b4133d59f3384b2ded02f4afc0N.exe
-
Size
44KB
-
MD5
f47ea9b4133d59f3384b2ded02f4afc0
-
SHA1
f6b2eb5b9745d3da4e157ae36f9dc2a695c90e57
-
SHA256
d9a067149f8e9a4bb79b4322f66c5b86e21244b223a95337256838f760a6b16d
-
SHA512
198dc0543cfcc2c18df0a0388e374f8685f7d508f8df6f1bbab5b1bcd60189fe32a68b38d7c9d19d73010e6c06a358571f4f3ff0b28efec9df4203a00eabfc51
-
SSDEEP
384:FBt7Br5xjL2Kd5AsAoh6n5eaOlIBXDaU7CPKK0TIh6SjeYDTcYDTkZW8b88:V7Blpf/FAK65euBT37CPKK0SjeQ8
Malware Config
Signatures
-
Renames multiple (3268) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000012029-2.dat upx behavioral1/files/0x0002000000010663-6.dat upx behavioral1/memory/2384-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\bin\kinit.exe.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\lib\zi\EET.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\bin\installer.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Internet Explorer\perf_nt.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jre7\lib\deploy.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp f47ea9b4133d59f3384b2ded02f4afc0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f47ea9b4133d59f3384b2ded02f4afc0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD563f7def9945ebfc91662c711f52788e4
SHA1ed2f94e4c9930d1642b300d2e2e18fc2658e8b15
SHA2562618685801b1bf1cc66d444a29dabc856a3ea7985eaf004f3edc04d52c724b76
SHA51204a21060dbd74ee24a831d1b55e6da64eed1a6d6f91172109c20a38e1ca8f881d87a6abb53c00381a95a8dc7b41daa1213e50b69a246cf301f08a4a22b6f9c2f
-
Filesize
53KB
MD501880c17c747454f00faf7bea7312db3
SHA1bdf5c48a0882d2ed09faa428636aa60a7916903b
SHA2566041b5a20da1e6d13e481d63ed8ffa93def28561077bcb24ce51dd53f821ceb5
SHA5121e09abe08fabbb250ad16e5412966db0fc11712e64aab42f53073d9dfea3b944dca92ba20fc808c446fb093eebb82d33405da63d3b85844614d8430c331ea1ce