Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 21:18
Behavioral task
behavioral1
Sample
40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
Resource
win10v2004-20240802-en
General
-
Target
40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
-
Size
32KB
-
MD5
0c424dbd79811a7686afcb87c145c131
-
SHA1
e70b634eae6d28f003606499f722988d1beff2c5
-
SHA256
40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9
-
SHA512
b641af75d242215c6b6dfa0ff3befb1d026b1634e1608672b57866bfa06beff512fb08883e276498dd46b2b5bcd513a393a5fb0fab8754b9a74192c5d4d74360
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBy9e9UfZfKF/MF/O:CTW7JJZENTBy9e9J2W
Malware Config
Signatures
-
Renames multiple (3773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2852-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000c000000012246-2.dat upx behavioral1/files/0x00020000000104f5-6.dat upx behavioral1/memory/2852-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Common Files\System\DirectDB.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Mail\wab.exe.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\sidebar.exe.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.tmp 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe"C:\Users\Admin\AppData\Local\Temp\40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD508f89800e87e3c21161e52fb0f9ad87c
SHA1d3c6c97de4fe9c8f9560b3d3aa0b95006574102c
SHA256b310ccbcc36e6a3812ac158680a82d6881a2c36688e793096a5d7c7f03adc7bf
SHA512b30c1a0c2f3ca28ea0b325f536c8d5de9780f017daf8c52d4806aea3501c352d7f0d6f01028973d8fbc9360b3c15f3927f3748c299f79e87c5391a3588fe0dad
-
Filesize
41KB
MD5aa7945a887f8e692ac57b9060953cbf5
SHA1ca02436d4ecf9d1c26c5ffb57adac897172b003c
SHA256050b2da7342a9beb2421a41b66f7fa4f45a5e975ac821fa89b6ef6f36ac934e4
SHA512fda28e83e1943af9b4edadf3d7b7aa3f3b810683922cc6ffe008fa50d5f928b2a7bcc5cde8d64f56604e577c0cf67f57aeaf70528b880b9c8c6f4120871697ae