Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 21:42
Behavioral task
behavioral1
Sample
5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe
Resource
win10v2004-20240802-en
General
-
Target
5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe
-
Size
51KB
-
MD5
a608de1ca455536aca850f9b20e7e3e6
-
SHA1
b426606a31e4cfb5271b4fa7be56191da3af2684
-
SHA256
5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca
-
SHA512
062e1ab5292bfe5f394de664d4b60dc3a7944b8f69adb0783f4ab303eed785cbfe6a4d083d5580ef99fcf3095817ce72bfc671db795e98fadd519ed3fa8b5281
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nP/+c+l:V7Zf/FAxTWoJJ7TU
Malware Config
Signatures
-
Renames multiple (3729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2280-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x00080000000120fb-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2280-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\desktop.ini.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-print.xml_hidden.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jre7\bin\jawt.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe"C:\Users\Admin\AppData\Local\Temp\5362f3bbe8c62de94d8fac9843520ba31e94ee25a20f660bd6b83bfe4916d8ca.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD53f7d5fcc5c2f666175e90859e3207d8b
SHA13f98eb32e172bd147088a418d65e9ed1c180dc88
SHA256c727470ebce85a5b70db501b535b47a567c3981dd5ff394548878e443977aba3
SHA5128ad70a22914429ddf44cfbd1005b39b1c5706377efc4b6cee59ea1b7a641a56ba0385f9ba2e7f6e6d9763bfbe1ea3a697ece0cc5b09cd40da7c1f020a42e1044
-
Filesize
60KB
MD52c6e096c2cbd7bee026740670d262ea4
SHA140dd6d6912c6f74d0fe12a73c0a6f95e86d09931
SHA25691ae983c87bc2c31d8f691de7149d1c201a3c2a06c0117b6cbddd26d3757edfc
SHA512b03b48632eb44f79cf523342f024db1ce56c278061ce01e1278ff9e46f589cd078dc23d1e29fb8f599622308d04399037f26323396625b24aa201134914081e7