Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 02:44
Behavioral task
behavioral1
Sample
e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe
Resource
win10v2004-20240802-en
General
-
Target
e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe
-
Size
102KB
-
MD5
5e2082ecee0731d699afb1e60464167c
-
SHA1
5f2f97bb12565979173b8448da21ec47b7d25bca
-
SHA256
e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876
-
SHA512
9af6b5366e597c583dc0051c45e8c9f3e1be2e3473a0f7c5749310313e6f0c4c44c2f0aec379c32e453c45b486e6b5ca641a2473ce2237c074e270ba54d3a960
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGdd:fnyiQSohsUsUKb
Malware Config
Signatures
-
Renames multiple (3440) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2656-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00090000000122cf-2.dat upx behavioral1/files/0x0002000000010485-6.dat upx behavioral1/memory/2656-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\CET.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\7-Zip\7z.exe.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Defender\MsMpLics.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\localizedSettings.css.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\picturePuzzle.js.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\javaws.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe"C:\Users\Admin\AppData\Local\Temp\e62d69b34c5ee5b49c8443c43f7761f78b727cf2be1472dfd921a17f59106876.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD52364c1d160d14946791cfb5b6fc8ff35
SHA1565cd80271759dd690bc215144c9bf67ea4d888f
SHA256d0f1ab085b57d49c1f90d4b75a132b9f1208ab485878f665881b009511ff4b30
SHA512f4b76b16ad49e29bf59dbc85d53f53caddd0467be245ba3c5d34ea04432e7883605ff43fc862759a3c36ee8e2fffec5d17af2c215a2246e9f576e701264f9bad
-
Filesize
111KB
MD55ae93a2db12a237e756085abf00ed36e
SHA1db001255f55ad353446d43680d74fa12354f592d
SHA2565b7ae7c8084180c7614864311188bf292e79537614ddc09a391a480a4c0b3778
SHA5124bb18bf3a9a0c23eeba941b7fbc74dce4fc5b6553c1b5c333c37ca808b310963add437da2a82d3fca14d317d946e3989888515d295d422e0c693e05eaf3ff48f