Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 21:57
Behavioral task
behavioral1
Sample
1fb58a80028c62a6dc9b3359e1b02850N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1fb58a80028c62a6dc9b3359e1b02850N.exe
Resource
win10v2004-20240802-en
General
-
Target
1fb58a80028c62a6dc9b3359e1b02850N.exe
-
Size
30KB
-
MD5
1fb58a80028c62a6dc9b3359e1b02850
-
SHA1
44e3808573f6f821bd3fe0d4fe0e9ecaa09a339b
-
SHA256
d0402cb26e1a4e4c67578681c28639a5fc37f2485838d7600f1d6dfaa8bc7bf0
-
SHA512
49c06a480c874af8cbb2ab81ccd322c1147465668df8de61b22494d29f48602c8329eb6a42fb516041185091dc95c04e9b1e0b011a95a67fc4e1755ead183930
-
SSDEEP
768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeHhli3:CTWpji3
Malware Config
Signatures
-
Renames multiple (3444) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x0008000000018718-2.dat upx behavioral1/memory/2628-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0002000000010622-6.dat upx behavioral1/memory/2628-72-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\ConvertCompress.kix.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp 1fb58a80028c62a6dc9b3359e1b02850N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fb58a80028c62a6dc9b3359e1b02850N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD59630de694a7878789a05e810373fafa3
SHA178f72e71010d3abad0fdbb5090f635aec55f243f
SHA256489865157e209408ffa843e93593bac4ae911ae53a1125f5c42ad8fd1275c654
SHA5128961b1c89008a38070a5bc974efe41a42c1e52df9055710dfaeea756a482c834b1d8407a614bfa6620dcae4984dfa4765d7cba9b7dc2d09e0fcd5583a91a0fb0
-
Filesize
39KB
MD59898f663b4469901f2f78a6f590153b7
SHA13179e8b6f124c6248a6748436606f1da99fa6102
SHA256242e100ad9b6462cd72b32aefc1902197144f71e94f8ef8b64a4edd11230d303
SHA5129584b93ccf39a7ac6087aac47a754a5efddb8cad737a2a61c8d905a555bba3616c0f67c567d7bd4b770e75040469a5e9d308abbe9434f2aaf622dd524715c86b