Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 03:05
Behavioral task
behavioral1
Sample
96ed70b101861a208d38dcdf14b43a70N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
96ed70b101861a208d38dcdf14b43a70N.exe
Resource
win10v2004-20240802-en
General
-
Target
96ed70b101861a208d38dcdf14b43a70N.exe
-
Size
40KB
-
MD5
96ed70b101861a208d38dcdf14b43a70
-
SHA1
5878701a25331c9307bd6e1d3f4bd0e4117d9c5b
-
SHA256
6505dd3e50f9fe8c4ddeac13840ce67d0bde8c991331bd30fd94d3cfffe99255
-
SHA512
85e90bc1ace44c624b912e2d9a267d1411f49b7a37550c86a68dcaf240fbbd9c3f6012bf4d34fae06ba0ff1f656613fe6e81a76cda4cb9487ae86bff42656443
-
SSDEEP
768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OSbo5+Oi6Jfo5+Oi6JvEXBwzEXBwz:CTW7JJB7LD2I2IbSq+P
Malware Config
Signatures
-
Renames multiple (3440) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1956-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b000000012281-2.dat upx behavioral1/files/0x000f00000001045a-6.dat upx behavioral1/memory/1956-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\bin\orbd.exe.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\currency.data.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\ExportSync.rar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp 96ed70b101861a208d38dcdf14b43a70N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96ed70b101861a208d38dcdf14b43a70N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5dab86ad1968e3bc19d64712ee201f318
SHA1f10d042bea4f3fc85ae612ef54b2c71db960600f
SHA256dddacc91a295ab3f842284c7ae2658db1494e48ad4a06abf1c7731c21cbb5ac1
SHA5128fc921dccd47c47dea7474ca03e94aa2e0d03bea0af847f5c7779e94a7079fa9616fe7fc00126c7809576c04515284ccfde9e9a66a9cd95fdc456df4d2bf82f6
-
Filesize
49KB
MD578441086279dd0876a71a39a0fd63418
SHA1bb8ed0f63f36198c3b38cd1f2efe4579aaae8511
SHA256064faf6091bb4c67c9ed5e3f351263ab032f59bdf569bbda8611df4ee847b212
SHA51287329256a2097e6473707763af7a2683b3a41cd82cf7c417aabedeb0b62ceb34ed6944a05ad98e6704ea69fe531b173c1127b25cc5419dde92d5eec54ef2cd81