Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 00:48
Behavioral task
behavioral1
Sample
9bd03ef4f42b221c088ba161e7b947f0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9bd03ef4f42b221c088ba161e7b947f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
9bd03ef4f42b221c088ba161e7b947f0N.exe
-
Size
29KB
-
MD5
9bd03ef4f42b221c088ba161e7b947f0
-
SHA1
893d809885bb6f355c4abeebc7a31876675883a4
-
SHA256
8078f92f571daf0ca0cc20fd9f315ca11563fed89bccb3f7dca9f78fbf87c071
-
SHA512
ecdea8e69fd2b6b62402d9f2f2461edc9e60211844382d16926ae9463f9e48bd664f2cc8518f5c45eae139a60487ec1108b1a1b4302c6fdf1e7ee4792882dcd7
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATB/yNhPn0DPn0n33:CTW7JJZENTB/oP0DP0n33
Malware Config
Signatures
-
Renames multiple (3439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2668-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x00090000000122cf-2.dat upx behavioral1/files/0x0002000000010485-6.dat upx behavioral1/memory/2668-71-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\precomplete.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Mozilla Firefox\removed-files.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Windows Journal\Templates\blank.jtp.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp 9bd03ef4f42b221c088ba161e7b947f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bd03ef4f42b221c088ba161e7b947f0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD55641e9df581ac48d7aaef8c576ee2172
SHA17c1fed359166258a1789e6b913f84e3229416452
SHA256b968cbcceb368700dd574029f2a5c88fa877dbc67465dca2d4b333e1b8f6e1dd
SHA5125bb9654dd2e5263d11e9be767cf047fbb2dbb3495bb58774679cd244d88df07f173bcded628360e79d5f9d415cce56b9e1c117239500b1d9805f619a53a26244
-
Filesize
39KB
MD531f6c319b739a241bff1f658fe9a9f48
SHA1ecf6eae528c2e45ac2f5c08dd297a457e2109a0c
SHA2567acd502b9af5db892457b95b0fe608986b4262b40b606c329c6f2a8834f3d00c
SHA512bfeee4c60a84fc85f5ebdbda648af710c19abd537989a3bfcb1d75e2b01023cbf576b94f86c63cfc926f3f6665ff16590ce85e9c707880c2aa41e1636fac9f00