Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 07:10
Static task
static1
Behavioral task
behavioral1
Sample
53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe
Resource
win10v2004-20240802-en
General
-
Target
53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe
-
Size
50KB
-
MD5
b558092992cc7ba3e4dc4d1e19f03b90
-
SHA1
dc67c538fbd937f1e0d8a3046cd7b575dcaa2be3
-
SHA256
53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93f
-
SHA512
c97204942c7b5a8df8cb6a75d083078be8d6bea5a67a460155df6ab382d2ff77dd1fe4ff02c11f44595f4ca17e7f13c33a76b3d63365444951cac4653b104c62
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhvszw/Evd5BvhzaM9mSIEvd5BvhzaM9mSqZsSb9hZs3V7j:/7BlpQpARFbhvEXBwzEXBwLtW
Malware Config
Signatures
-
Renames multiple (3270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Pipeline.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe File created C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe"C:\Users\Admin\AppData\Local\Temp\53bf9652f4a495fd5dba45ff6fcb0d014878efb299ab7e5bcd86f96c7ba9e93fN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5e5fe27efaa8c4ec047828ae616f03fef
SHA13c509195137190d664de4898843eecc560316b38
SHA256b74a4388a58d02d69b001e184e14a8f3a7a34913a8c3dee3a42944fdcc0d9e04
SHA5123e736f4b5a506694d75c96f2e9ef057db4b0df51f7c9112dc5ea8fd23219e1d7b2d27739c16fe5186bd23b29b2b9fa4d9043b3b5ca666a056cefb81fb46e9d77
-
Filesize
59KB
MD5b5bccd50d6610b9d909d6ea897e7b79a
SHA1370238846b412f71beeef82c5e461f7c8372a479
SHA25601f90c51cda0314228d6f10889fea621d7c2bc061ce8b15ff10804381768508b
SHA5126d5d709e705d977172f958637fda46c742e81bf0649676b0c7af60cb5a0e42bc4ac6242e5fdacd17a3e1e6bf7515367879da60f3c913b6d46603beaa4d3b11ff