Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 18:15
Behavioral task
behavioral1
Sample
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
Resource
win10v2004-20240802-en
General
-
Target
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
-
Size
38KB
-
MD5
6a7710bfd0b7ba252b7b10ea7387ce96
-
SHA1
55b66324ee189d7d094b7fdd92d9f7c951c4a19b
-
SHA256
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13
-
SHA512
16de6407853ee3d39b6a40c7193171c74ebd43967a94c2742403dc4d45d7f4c2b4ce37107699454f5c34fe99e2815ff9b50b75897faf1ac0100defddd16ff868
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJPbUSzsOVClbdz3sJ/F8gzbdz3sJ/F8gm:kBT37CPKKdJJTUNO/
Malware Config
Signatures
-
Renames multiple (3826) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1892-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a00000001202b-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/1892-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Journal\NBMapTIP.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tr.gif.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Internet Explorer\networkinspection.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe"C:\Users\Admin\AppData\Local\Temp\028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD532372228121b7fb5c96177aa2ca28603
SHA1f7d74f03dc0facf7b347b6e58b706016ae891f3c
SHA256606fd819c24b9d85b707bcc768ac4809daefdf7c84acd71aa6e04e669a7b5524
SHA51262384e21f71f5d445ffa0fd95bcd26cdd197f710798a1a4382c6d555921716a071ca682453c2f015c8615c0067e46f96f157b28c49ccf95e112ca1b4f7a969b5
-
Filesize
47KB
MD583928a36e12f296840068390220b74ad
SHA1654fa9962ca0086a67f55ffdd36a498862bc6337
SHA256dd4cde023d8faebeeacfecaa5fa1e91b4969c011afb49b7e79cc5e4aee41171f
SHA51272352a91a56ed70b7a7e5b16f535fa19929eecfb785496194f7eee42a30dcfb0fdacbc2673701bf0a787eef964a0cba38c964b8585e5bd4f527c5c36fc140514