Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 20:24
Behavioral task
behavioral1
Sample
892abed12f68b601dcddefc7ab831ed0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
892abed12f68b601dcddefc7ab831ed0N.exe
Resource
win10v2004-20240802-en
General
-
Target
892abed12f68b601dcddefc7ab831ed0N.exe
-
Size
53KB
-
MD5
892abed12f68b601dcddefc7ab831ed0
-
SHA1
dba3b76c6a5b331e0c7eeadb6b540833a649e652
-
SHA256
1421c92e27ac6dfb30fe35c219993412de7f1f541adb1634d078cf975a78b5bc
-
SHA512
939a55a2f35dcdb5b6276f15cf85ad55f9c3f007f2aa6da07ad51fa8951a9e30fa2e80bebaf3fb14471d8c0d1dc3f509568a12fed3f3009388fe6f119a865c65
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBKqbKt:V7Zf/FAxTWoJJZENTBKqbKt
Malware Config
Signatures
-
Renames multiple (3162) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2072-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c00000001226a-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2072-68-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\OutGet.mpeg2.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp 892abed12f68b601dcddefc7ab831ed0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 892abed12f68b601dcddefc7ab831ed0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5d242de177153cb3dac6f827e1ad5a854
SHA12ea1c0a2c0fe808feda1196687b808a5bb6eb146
SHA256bb42476e443030fa0c67204b7c9700c39c067a48b98ddb819bae9a1b92bd8a65
SHA5121c5e48e2452938aa30da3b520060abbf21e7dd9a0733c09bb74e42e721a7f99ecf164e4d2ef2acf6e4ccd424c56dcff14828807a29887413910fc0c659e62a25
-
Filesize
62KB
MD54247b9da2e168bd06d614875680bc35d
SHA1c5609c25da800435b680231de8cb2f52e4ab3182
SHA2569186f9cae98698f1a81ab92ebf633fd041f07b99f90c45426bd5115b24c7aba5
SHA512c372effebb21d23c130abfa1283bf539fe2b94a2a1730262eb8afa62adf9e4e4a589a3e497b08891e685f165f2449e8ee8cd0a37a168b5f299b534e5c38e8c86