Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
Resource
win10v2004-20240802-en
General
-
Target
33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
-
Size
76KB
-
MD5
75bf1ece637c4d31d4122fcdf40ff0ee
-
SHA1
5c46fee7a2119338e94cd06b94cd3538d0eab981
-
SHA256
33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68
-
SHA512
d0c8948c4b24a1e9e23bbab0d896245f6ecbe7f6f0cc2aae68f6c92fd53575294c9baf96c7fd59b1378bb9d6d24ac0c4434d5be540daebeb4593c49d38a6fb48
-
SSDEEP
1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8zxY5eYm:6e76mQSox5u
Malware Config
Signatures
-
Renames multiple (3486) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\lib\zi\EST.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Mozilla Firefox\postSigningData.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)notConnectedStateIcon.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\bin\verify.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower.png.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmod_plugin.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe"C:\Users\Admin\AppData\Local\Temp\33a8482305e922ed1540f90805f46064ff2e3299ce9bc9073b413abf07829c68.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5dc4f59a4d0e34b48a01de5ab4402e3a5
SHA1697f9a8791dab2fed5cdb5bc9eeec8d61aebba36
SHA2569dcc5f6fe2a00ce23e5b08539a1e0966a0ce5a3ea5588cf24ca76a6d41a9a5eb
SHA5129127a2d84e76e76cdc85a813c7835e1d4e7ec716666d8261a9e089d877d2710addb27a089e924cfee3752be4e4a8c375f7961b789d3a4fcb0979b3ad29fe0ff8
-
Filesize
85KB
MD5a85fca67dd31dd2262c22e6b6cb3818a
SHA11e252cfe6510b87b9b460c69cad498a1bf89916e
SHA2565d084f78870c0f1914f611c76fd04a45254eec5d8d77ab6a472b7b89effea8f6
SHA512b564da223912552e6ba906a44c3e9bf075a01d6b83dd1d03167bbb6adf0a0d8c37e522d337dba1589b32ef0898757de00ef7caf52f0aceecda39a785dcf4e460