Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 06:03
Behavioral task
behavioral1
Sample
ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe
Resource
win10v2004-20240802-en
General
-
Target
ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe
-
Size
69KB
-
MD5
7c079312921ae5f192f29044c74acbb0
-
SHA1
c880fdf157fd811b16ff8f6fabdeea3fc1567d7a
-
SHA256
ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1
-
SHA512
1678c40367dcb3534f98142559996a3f0c6bc4b469d2abccb44906ee1945203968889409cb2438187271d45e363620a6a2bd4960a9fc740db71cd11a06328eee
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTNyl2Sm0mKRgZg0C44enYE/FXHFJV+C44enYE/FXHFJV6:fny1tE42ERgZgM
Malware Config
Signatures
-
Renames multiple (3219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x00090000000120f9-2.dat upx behavioral1/memory/2424-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c000000010546-6.dat upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\bin\management.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\bin\jp2native.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe"C:\Users\Admin\AppData\Local\Temp\ad87063fcff289d9ace99453ab67c42005183e7ab1341ab615c2eaf9dcc587e1N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD56120aca550878f713b1d126e9c477f59
SHA1810c6b19b01d3eda010d821e771be4f5c328f975
SHA256746e9713834dd5eef5c06e02370c7c59711726c2e58310dd9bd4b6fd875ba1e8
SHA512f17b42f3e69912744b921109a313492ae15eb328c8197488f36e84cbe4407b2869ecf5b7b4dbf4aad9c114e154f46eac097a23c9b6139f317cb6bb7d5bcdf4d4
-
Filesize
78KB
MD50fcb053182eda10ffde045feb8ce0e7d
SHA15f00f8c74682a59be0245fb8bb26e39d1cb32b09
SHA256ae161a0eda05b860fa215800e6cfd010257d383cfd05bc97fe55f05725eded26
SHA5122ab12140427f20c0ae83698918df52f6bfe5d97c9e5c428744750330702aa3d26c26156885b19ff322fc9495696edb1bbc25e330a1f8e3d74c6ee38489e3f9b4