Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 18:49
Behavioral task
behavioral1
Sample
1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
Resource
win10v2004-20240802-en
General
-
Target
1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
-
Size
25KB
-
MD5
99e6bb5f56fbe0a15a53db813c71ab99
-
SHA1
21f506816cf8623ecdf97d3b97bf7bcb9f5514a6
-
SHA256
1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436
-
SHA512
ccd759d0d9022e19a76a0be2bd9fafb5c46c0c9e22f884b7f55e01013d20b3791e64d87075ba368b4f43d82d754789db82dd49eda2b18dbcd91ae2b0772dfa91
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9Zmuk:kBT37CPKKdJJ1EXBwzEXBwdcMcI9nk
Malware Config
Signatures
-
Renames multiple (3704) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2136-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b00000001202f-2.dat upx behavioral1/files/0x0002000000010663-6.dat upx behavioral1/memory/2136-69-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\bin\unpack200.exe.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\picturePuzzle.css.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js.tmp 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe"C:\Users\Admin\AppData\Local\Temp\1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5e84ff109d5d2af94b41dc2be645e5520
SHA191a12ac83aad00ef3c8724f57747156b7bb026be
SHA2564c065272d31e34db90326fd32f344ea99ddfb81c73b39ef51ac572be7bb471e0
SHA51286b95693a3a3cadb7663d21197723d8f155e75fa996072b1fa29142f38a5250b9ace0c2b0adb4704eb98ae6ba318262739570b47ad7785c261f3f93a1105c499
-
Filesize
34KB
MD5bb60d69aa8a54851c1adee1633a19a39
SHA13da4f116f6ccd124ea3de3bd5d9e79a31246c54d
SHA25618aa4464e185d1484dce8257fd8ed530bdadac2af42f46a8770b997c4feef7f1
SHA51290bd64da2b6473867569c5fc4fe2e58d72a8c09f254bc4f81ed8a21c4a2439520d057a54ee2fa7e9c6ad23b73343a6f5375a832c672aeb677c0aac5a66cbdffb