Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
Resource
win10v2004-20240802-en
General
-
Target
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
-
Size
72KB
-
MD5
ba33a95231a279c05c015444b0727ca0
-
SHA1
51258bd670b5aad477f7978cf7e527b33d48d60c
-
SHA256
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113
-
SHA512
3475d30da2c1bd6b571e806e2108ddc94a7d7daac7e9e7d829beec36fc1a72e92e1570f41a77d5de6a3ab63e3faab3c6c04b0f168ce416040c96e58b499a540e
-
SSDEEP
1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwEE:62ssWpcU7lK1lKgkE
Malware Config
Signatures
-
Renames multiple (3157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Internet Explorer\pdm.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\lib\plugin.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\vlc.mo.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe"C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5f83fc727948661d72ebe6cc689c365ac
SHA180f33e132fcd7a02ee0c1207e321a74c8b9350d5
SHA256b35c26b2fd6e2ef8e3508cb12e8224a1e0304c496e5cce49d983975caa67a7f6
SHA512a9a2fa1cca16d4066d2051dfe7ef27b1957898aa18f3e41593465967c581556589d53a3e28c62e5ceff83fc4a32d70f1ea26827c833a4c52257ca4443d4a16dd
-
Filesize
82KB
MD5b10b189f62b563980ad3808ebd001e55
SHA14fc777fb873dadef3eefb6db5a5e89852bd30483
SHA2560451db0cba539d07bacaf3001b79ba7916861773d715826710264c648d065fd7
SHA512bce5d3222c874759df5c5d442597c40cb071bebb65c5d2b32b74b95a344703090707386fb05751105fdfd5543c97fe1d34b502b2a1d654447a98aeb776c8b9cf