Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 05:49
Behavioral task
behavioral1
Sample
2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe
Resource
win10v2004-20240802-en
General
-
Target
2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe
-
Size
79KB
-
MD5
4fd4da4a92c53f0b525339a830ca16b0
-
SHA1
2ed85ffb8ad147b1dc8085c15b8b879ccc8d4a62
-
SHA256
2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92
-
SHA512
9674f038f2d3579b7135d684347fc4d478a9a320e759b8d3210e31c48df98f4008bd0ec56ab783bf6f5d72a4e76fd10e110c027335aa85b83c56de242db05314
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZM66:fnyiQSo7ZM66
Malware Config
Signatures
-
Renames multiple (3120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000700000001211b-2.dat upx behavioral1/files/0x00020000000104da-6.dat upx behavioral1/memory/1700-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\flavormap.properties.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\EET.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Mozilla Firefox\updater.ini.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\README.html.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe File created C:\Program Files\Mozilla Firefox\freebl3.dll.tmp 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe"C:\Users\Admin\AppData\Local\Temp\2eba5e8e62bd8a6f2b6b8bf8f1024be057fc5b75891250745703f6196f8e2c92N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD54f9dbf1edaed69b5d4abc6229620df40
SHA1acc223f26fa3f74f1b8ec2ca8b7af9723258f3e4
SHA25608b92c2786593f88c8155904c7c5fa13a31dfa7edbceabfaf3f54a026e821cad
SHA51291edd7f9667c3f2d49bf2035086d4578dc563caf13b2391114afb5c16d3459c5677ac8fe78068622aefa3ac6d3e16b18f2347ac5f89373176f7383cd9cd4f361
-
Filesize
88KB
MD5728515ced8d881a4e2e7cd352d582b49
SHA15e9e1e4f61bf49c76f348ce247bb42da31ac6dd6
SHA256a4ba7090987e9da7cf8d497df527e8ee24e4153d11370ee58b1de94659d6ae15
SHA512cda40ae4b56d9a382c0f43dd728c53d25c00104f2f9b8a46ea3a19865576eacf552d07d0849c2454f75e0bcaf4f62ff5700a1850d7712db0cfa71a9f7120fa82