Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/09/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
Resource
win10v2004-20240802-en
General
-
Target
755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
-
Size
75KB
-
MD5
e70cf19e53c2063103612497427f39b0
-
SHA1
f690a26f470e7c83edd3f130fa6653582b949c6d
-
SHA256
755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8e
-
SHA512
9577331b755ccbc73ca3733c9e07027b3c0d3775a3819421c658616874500c89ff3e6ecc0504b3ccce439171b2576deef5375d243af66d546d0e864e7b8ad0be
-
SSDEEP
1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8+CtlYSDAQ9:6e76mQSostXDAQ9
Malware Config
Signatures
-
Renames multiple (3139) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe"C:\Users\Admin\AppData\Local\Temp\755ec5608665f077d4ea93c49f1c4b353005f48ebdb52e080b298fcf219a4b8eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5e63106d88577ce0b8541ebd3e001acb6
SHA10b2aa3cae3a0f15acf3aeb7430083217cd0e8d6d
SHA2560d14f03a42b4ab1da054372ec11466c38107536161b39041a564ed391140a1ce
SHA512dab5fe10bc9110834b5f7a7b7ad5a0785a958828d384a4842381203541c42c9e37a6b67de4ee8ee19f529cc1d9c58165a0227b3d42021b62a602f7726ddc9573
-
Filesize
84KB
MD525942c6d26002618f4cd5aeb9650ebc4
SHA1d10bf4cc4396ce4072d51497aeb313f46ccebf29
SHA256fd3be7bbda760f2a9aac985be7d5ea39177698a0b44461b8088ab0a517c11d4a
SHA5120e300d82d78cac6ece8f58fe678c3fb000b18ee45dec05962a789525bb15d648d1c6677983135263a4e8f6a9fc7374fdec78f7f55f862e6c5d801d97a7d6ff05