Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 20:18
Behavioral task
behavioral1
Sample
38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
Resource
win10v2004-20240802-en
General
-
Target
38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
-
Size
85KB
-
MD5
d773e792fb3804582f93283d694bb6a4
-
SHA1
944719faa280cfa2fcec7fc30e0f426d613bd077
-
SHA256
38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603
-
SHA512
ad1963b2536df6b57eab6a68208dd3fc3cea6d965531b01936401b5d82c87c5b6353b8ddf0647cae9a38624289502140456c73bc15381cd40ef2517fa3ff8955
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8+g9VyjVyDeUeR:fnyiQSoCeUeR
Malware Config
Signatures
-
Renames multiple (3547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00090000000120fb-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2396-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe"C:\Users\Admin\AppData\Local\Temp\38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD571ba6182a2f19377b83a68f24e43c49e
SHA1f9d4219f530d00e7591458cbe7a4520b64d95c69
SHA2561cf622767d2a9487bbf70ed0d13cf38928f5c5d2ca3633d5b149bf4af696ad80
SHA5121ce169afa431882062ef7748f20b9b2e6ee5c7af8d9148143ed890cef4dd5c0502d93d1c02023e5ab4b3435eda277e2f54c567bfd87cf4e280c925f1ee47818c
-
Filesize
95KB
MD5a4edfdbad2955b69cd3eb622236d9981
SHA1e2de108fcb218a44f18e260e8da16a86d142ed75
SHA256202c02a04094a8dba410c4fa1b6f6527a0646584722b47a0ba18701f9cb81d06
SHA51217ca67035ed010d530cce43a52713d2d1fc4d2b11550fdf5bfd3dc867bfc51a83f545e0566e7f17fa6aa4669add1b0b652b40bf47d4deef47195522b7bf5b4fa