Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
73f6da396f58e409024d5cb1e555a4c0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
73f6da396f58e409024d5cb1e555a4c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
73f6da396f58e409024d5cb1e555a4c0N.exe
-
Size
120KB
-
MD5
73f6da396f58e409024d5cb1e555a4c0
-
SHA1
e85b8600d1ec60336837d3df1a4a134c2b2f15a0
-
SHA256
e39c603fa1291d77c76ceda44ef1ce12db76d51bd9ef927fc780797d7dfc43bf
-
SHA512
d82c1b50406aa2c6bd1ec192b9a725478d6b18deee85920c8a492120ff104126db1136c3af9fd7fd185305b0ca53242ebca02ed5da16cf491dbfe9f0dbcb73b3
-
SSDEEP
1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlfS:6e7WpRaSljZS
Malware Config
Signatures
-
Renames multiple (2865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\bin\jpeg.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\DVD Maker\Pipeline.dll.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp 73f6da396f58e409024d5cb1e555a4c0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73f6da396f58e409024d5cb1e555a4c0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD55a2dfc5377b3e6adbd8f2ef9199a7a45
SHA139ef746fd8743dbcdd601d0e36753dd8a0fbb161
SHA2565c174d1b4c76b3273db062e3858ce324fb8c127e1f9c75eac2e7a774671c7db3
SHA512926e058c1f793614c226df1bfa9451033abe7b015ee8db6b65d8a75a839e58db0f6663f05c5bc79de45fc8c9c3ef7c0828939a5cfdb67852a403d13aec8f797c
-
Filesize
129KB
MD58b72092e4978f68d1c2a53d8e81512c9
SHA10b2c63e68c9a67587e8e33b95cae4ae848423ccb
SHA256f5264084e3d9c295b291df1161d30b53d89bfa70ec7f4a163494b27dfe1cfcce
SHA512f28e6e5c812f538b959515d9d8ec848fd09c4fed1ae8128b219767c61b5f1b589f7f8faebc018157fcef769e330835a80e801f51a7f00b44e75126cef00bb5a6