Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 22:07
Behavioral task
behavioral1
Sample
6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe
Resource
win10v2004-20240802-en
General
-
Target
6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe
-
Size
54KB
-
MD5
479ee7515d94af8d5cb72e02f46f2b2f
-
SHA1
be6fc444e5b2c39a5ec12e2ccff3f31c83b46129
-
SHA256
6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6
-
SHA512
a06c5fc92b67e45e95bbf26da0191d759f0921b28e566dc4add0982557d753f1496f1393f2438f00a8a5fbef7a5a748961bc8ed4c19aab51e0cd9d815457a552
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PU+:V7Zf/FAxTWoJJZENTBHfiPU+
Malware Config
Signatures
-
Renames multiple (3875) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2264-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0007000000012116-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2264-74-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Mozilla Firefox\freebl3.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Media Player\wmpenc.exe.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Internet Explorer\Timeline.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Flyout_Thumbnail_Shadow.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jre7\lib\currency.data.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\gadget.xml.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Windows Portable Devices\sqmapi.dll.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe"C:\Users\Admin\AppData\Local\Temp\6578b16d8626939a87c846f585f8f6718e6e19848f70b94d69a1a74670a6a1b6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD534097b1896b39f72cb6f704ebe17b17b
SHA11f178dd65cc38af8ba5d3aef8f8ec5d031301f05
SHA2565e6659c7988dcf81c5288b6f021a355041fb4a8ccc5c5dde7d81be8458c098dc
SHA512a869e70638225cb72a0c746c5bce1f2e6acfb31d39563a608b4a8ac8b51caeab0781cb19036fd82abf84d86c0487e7b029cb03d5beef6ee7010eea18b6b8e5e4
-
Filesize
63KB
MD5f8cf032339e8404f69cacd2daf305078
SHA130cf8b14988439ba0035c5ed1a6755f1882f7287
SHA256d6dbf8e58fa50f983f56988086f8ad92a522d4c458880809af125a25511372ff
SHA5122f44ace8c0b8780e420aa18fc5e99b06beef54378ed2e38c59a58d06617cdd163c83ded54f4883544e1f1550f68554bbeb20e7359b6810545a4bc2c2cc6cfd62