Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 03:01
Behavioral task
behavioral1
Sample
8760ccb3d073a0caa863eaf6881f80b0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8760ccb3d073a0caa863eaf6881f80b0N.exe
Resource
win10v2004-20240802-en
General
-
Target
8760ccb3d073a0caa863eaf6881f80b0N.exe
-
Size
27KB
-
MD5
8760ccb3d073a0caa863eaf6881f80b0
-
SHA1
0f91972feb91c44bb09b287d39f90ce232eb1125
-
SHA256
7698f5b35b8fd891e2b36cd64ab6e50916d91d029872d92e8d9891c4be52ebd8
-
SHA512
4546500b04f809c267f045e3c1c041cf269c8a6c7c1b4fd772229203ba16bd21faa6abc2f16ebb5a26284ed7affdaa08f1b5174ff17ff98949dd4fdbab79c511
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9oRf:kBT37CPKKdJJ1EXBwzEXBwdcMcI9oRf
Malware Config
Signatures
-
Renames multiple (3453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00090000000120f1-2.dat upx behavioral1/files/0x0002000000010557-6.dat upx behavioral1/memory/2976-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\security\blacklist.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Mozilla Firefox\removed-files.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\bin\eula.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\tzmappings.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\BlockDismount.vsd.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp 8760ccb3d073a0caa863eaf6881f80b0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8760ccb3d073a0caa863eaf6881f80b0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5392b7d81645a182107e4cd5c91da8531
SHA14e4eacd4c3722692452efbb21322ffb13dc0d2a4
SHA25671bb0df3ce7e6f8f454fa59a7bb161aece0ce9a512956049f584dfcfe47a51dd
SHA5127bfdf4f68347a980d2be767026bbb7f1f61ff81e7118d4aee831fde6c1aea7235761d99786c30c3668dc6d641a3647dc1ce6921ed74c859b4f1f3624849e9864
-
Filesize
36KB
MD5362809e2979d46456c5bd67fb48aa0e4
SHA19edde7d32a3c4b48fd7e13c091ffb840a2744af1
SHA25646cf696dd0fda887e88d53303d50d3c9836b4bc6251dbedd679c4cf1e9e439ae
SHA5125d55d43847dd3f830d1f52455da52e91dc7f6fea9b322b40539fd07c09c7a57aee97edd1660c236bce7b324359e3ba95a51028498af37705c944413959d2eb6d