Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 02:03
Behavioral task
behavioral1
Sample
ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
Resource
win10v2004-20240802-en
General
-
Target
ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
-
Size
31KB
-
MD5
414bff82428a1bc05cb63812fa1a6094
-
SHA1
cac9595ae2ff76aba344485cc2fa4c5ddba8ca2a
-
SHA256
ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3
-
SHA512
2aaf360999749b8946870282992679dca78f2701b23c0fc737dbd947fd24bc00d7292223b83f280a2988c2d894b8f50d63acf5d3059dc4644ce946af78037490
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+91ldUjq:kBT37CPKKdJJ1EXBwzEXBwdcMcI9P8i
Malware Config
Signatures
-
Renames multiple (3767) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2368-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000700000001211b-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2368-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jre7\bin\unpack200.exe.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Journal\de-DE\jnwmon.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Media Player\wmpnssci.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Java\jre7\lib\sound.properties.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.tmp ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe"C:\Users\Admin\AppData\Local\Temp\ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5adaba7e66455bca660b7d648655e35e2
SHA16c8a3d5fe1b0156196ac19ee3ec3017d7bdaf85d
SHA2568d37e552bf02e59c1acbbc7040a0c5f7e27a5a0589838f348400f1bd620830e4
SHA512dad3401f9d8d14c1bd36e82ed327a87762dacc8af336a6b113ada986c729eaa95e107fee69b0008dc0bf140fdf1550cb0bcaa5e740c13748664eb0eb376307dd
-
Filesize
40KB
MD53d6cb5d5418629f098e92f4372e46cb7
SHA1d3f8f4658b5b7e96c4260ec666d9813342ad091f
SHA256b898a8b91c1fe228395d760766a738de810f00a60c6606a7669d01b424b75402
SHA512d770acab7c7b52885a699e6eb91971cb2a8085df787a6a0c2f94b9c6f9aaa105868d2d78d2ff64ef44afde55c89992388968f4e60ca0c12fdf7f530e24cee5d9