Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 18:22
Behavioral task
behavioral1
Sample
0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe
Resource
win10v2004-20240802-en
General
-
Target
0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe
-
Size
47KB
-
MD5
7ae28b256f03b46c2a4c105e2462bff9
-
SHA1
cccc20dccecdff5f5c44ad45f958583d5772cc47
-
SHA256
0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d
-
SHA512
4159e85bd06debf96d75a523080baedba809f7d4df6e74544ea7cec8d027dfc373dc270518e840110936dff8c6713b07fe132edd38d2a3d62c14dedb18445dab
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9dZN/:V7Zf/FAxTWoJJ7TpN/
Malware Config
Signatures
-
Renames multiple (3738) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000f00000001227d-2.dat upx behavioral1/files/0x0002000000010622-6.dat upx behavioral1/memory/1720-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Media Player\WMPMediaSharing.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Defender\MpCommu.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Java\jre7\bin\ssv.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe"C:\Users\Admin\AppData\Local\Temp\0636904df72c7bf2791a242faefed8c0f222eb7fdde554609453e031fb063e3d.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5bcd762f3a4d7ac77cc9d2806af12aeee
SHA16c9a87f85ebb7f8d029a658f825b8063595abdec
SHA256eefca1b3805f8094cf8b1db4916627f474ff96c0991b87b04d199dbf9f849092
SHA512d91f986e4a6d59c8b97306993ad31b15dd6c85f48304aca1cef345d7278422ef76c9d41b9668a93d5330534a48df7dd7771daecae472f252c5b04c8c21047bd2
-
Filesize
56KB
MD5d4fe6fc0513d77c68a490091d423d5d9
SHA16217685ed183b5cb6bfc70f509fb27830304cf69
SHA2563844ca17a589f7f2b906fc871a9b6fa0bd0b049a78c2640545d93ccec99da427
SHA5127c42cf2ada5273a3f63c7a7b6f38cc7a9610141374d96217a9cec63cef9ae2d99843fc6d907e5027097c2ab98c9c2ca91278fd5bf06c74eb72d68e227b0ea681