Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
c6932bbb479df23f84056149158a6bf0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c6932bbb479df23f84056149158a6bf0N.exe
Resource
win10v2004-20240802-en
General
-
Target
c6932bbb479df23f84056149158a6bf0N.exe
-
Size
49KB
-
MD5
c6932bbb479df23f84056149158a6bf0
-
SHA1
9a66bdcd113c4ef4a06bd633de388aef42b47ce0
-
SHA256
321e9bfd4e98d30e149e04ab20efd7870dc3088162f39b915a05a5909a21f715
-
SHA512
d21e534a179023bccf32a0163683a25b9998c073daf4ccd1fb09583ca84800333cf1715ea59ed92ab11e74185f0e61e4c840c1a44c30e221adeb9e69de0403bd
-
SSDEEP
384:yBs7Br5xjL8AgA71FbhvtzyKbNzzyKbNrwBBgwBBQ7xmDNZ87xmDNZZ:/7BlpQpARFbh1WK9WKzxYbMxYbZ
Malware Config
Signatures
-
Renames multiple (3180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\bin\javaw.exe.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Mozilla Firefox\update-settings.ini.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\flavormap.properties.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\bin\jdwp.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp c6932bbb479df23f84056149158a6bf0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp c6932bbb479df23f84056149158a6bf0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6932bbb479df23f84056149158a6bf0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5a1d6b4ad5ac1114fb387ae33b07765f2
SHA135a1b2810a8477c5aaddd2f7b2df089bf197967d
SHA25623b0428a3d3bf2a016b153fb9a1163ef55b07e3cb07b98a6f39a74fc21aa511d
SHA5122fe420640aaf63650c5dd42dd3d17ef35e68bf81979758ad5b0542bd3bda096a3db3eff328fe8e9e1bac5296a494f6d36df41c2a96f3194bf16e18dc7424a384
-
Filesize
58KB
MD55c014edd959ae6facab735eea26cea54
SHA175360e84e5b1488015f892695e1e087b4fc74ccf
SHA25603abac077d1ebdab25c790ee63323864da25e026053b93703c5a71f273bb3266
SHA512b50263ca5ee31387d52787d000fb8739a8f25f320cba61d5b5f08bcdc2f7515c3dcc21149db01d580413fc8b4cdd010234e8ff96f8d1a67aa565e239300c6a43