Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 05:25
Behavioral task
behavioral1
Sample
eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe
Resource
win10v2004-20240802-en
General
-
Target
eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe
-
Size
34KB
-
MD5
81cd2bd6725ec35ecf079fede8cea375
-
SHA1
0fd62c2ade96f78729967a265c9e0d3d59319b5f
-
SHA256
eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c
-
SHA512
919c478dc0835773e99d180ab743743d6700de80da8246c1411f137efdca767ac31979079d3855532ce77ba1ce3b822c5acbc58e8eca2dc8e8a2d1cc8a288ba5
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9lBT37CPKKiUv:CTW7JJ7TdTWx
Malware Config
Signatures
-
Renames multiple (3813) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2028-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00090000000120f9-2.dat upx behavioral1/files/0x000f00000001045a-6.dat upx behavioral1/memory/2028-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\digest.s.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe"C:\Users\Admin\AppData\Local\Temp\eb64eadec7e865b276631e6491845b81f13b4ddbc04c284f60b298e1d4fd732c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD537e1bcb5b6b384c38d95d051762475dc
SHA122892a65bceaa2640858973cb7f4c754e07aa9b3
SHA2564a713e26c3530dd3380a439389b156cb7e72800990062ed15cd0b3e8cfc44cc5
SHA5122c4083ce004617e21afc515edd9c4fc37e48b705f67b1ed74bb8d6738cd02b06c0d6bc5deed7fbe1dd36b988572ab8550ba4ccfe864ff5b88ab331cc6c1efa3a
-
Filesize
43KB
MD5673d4ed12f7affb7bf9fe55f9d8d3284
SHA1cf939934cf9d0311275471eabdb274b0027d5ba1
SHA256742b23e33e9aef0cf5c29769c3bf5f94ec8a3e27a81ec3e95170ebf82b57dcba
SHA51214718d19ec137a905332f23ee90fb0bc83b9b4a15e97ae4193e4842ec01318992f97c6c2cb729fff94e4bc6f6d6c3070b24b6271a227402882860f4fd3bc1f5a