Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 01:30
Behavioral task
behavioral1
Sample
c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe
Resource
win10v2004-20240802-en
General
-
Target
c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe
-
Size
83KB
-
MD5
c44dda680a23d1030ba57dc9360eaa40
-
SHA1
402c0d0d64c6b1dc3e7314ffafcd8affe128a9dc
-
SHA256
c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fb
-
SHA512
7e84a42c7a41a648ddbdbd8d41860dc9555efacb653e2d2380d74756f14660a8585de1efbe4cebbbd81f24e86e6c6f878743ebce936f4930cfb98d89e0104d3e
-
SSDEEP
1536:V7Zf/FAxTWoJJ7TKyXKoyXKoTW7JJ7TKyXKoyXK3:fny17KdKv7KdK3
Malware Config
Signatures
-
Renames multiple (3459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/3068-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000700000001211a-2.dat upx behavioral1/files/0x0002000000010541-6.dat upx behavioral1/memory/3068-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\javafx.properties.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Mozilla Firefox\platform.ini.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Defender\MSASCui.exe.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe"C:\Users\Admin\AppData\Local\Temp\c4ab87a1f8e20f25ec34ae0e0a2c24e25ffb6768d85fcc5ec9081ed6ccab00fbN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5ff21cce286b20d9d88616da424cc22c4
SHA17f37ebee1d8709ff08ddf8c32170238788ee6082
SHA256edc14cbb252b24a0a2645488224ee4cbf90beee9d8424603f874d03727171ead
SHA512b0d174a9a038068bbb281255f0733d6f87ac9893b273d9bedf943428eb573b6f7d516c755662d6055c5c2a490e1654fe2433022dd2621e987f700c38952d1895
-
Filesize
92KB
MD551114577d3b8988f0a86addf49cc9635
SHA1418119acc16f472cfb7eb45731f6d96f7b3dfbcf
SHA256034e0f8884e4984265a99136f2f2ce0ded25799ebe7af596598fc1aec9a77c20
SHA51271fee683c508bcdbd64d644be44bf838e027b78a38f40a5cc5af26b69bfcd964c02b09faf04455122158a0580f088841a846e24b885727197421bc95032911c9