Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 13:15
Static task
static1
Behavioral task
behavioral1
Sample
f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe
Resource
win10v2004-20240802-en
General
-
Target
f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe
-
Size
61KB
-
MD5
0d2d208cd8865bebb4dfc777e34c7c10
-
SHA1
af9ec8406771bf61e637cf63388b651f2518ffb3
-
SHA256
f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1b
-
SHA512
7a8709e7d14296e407f127e0c29dc9dbd025241a3b0f577e9f425f4386ccb33189162a1fba9129c43ff003b8bc269db62f6b77ae11473a4e4548503d884cc858
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhv/Fzzwz72Jwuq2JwuR0U0Iap3gyaHq9nwK8gvgyaHq9nA:/7BlpQpARFbhNIiJwsJwwnZap9QKQD
Malware Config
Signatures
-
Renames multiple (3209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\RegisterBlock.midi.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jre7\lib\security\java.security.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jre7\bin\libxslt.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jre7\lib\plugin.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe"C:\Users\Admin\AppData\Local\Temp\f6e06085327ec8def82ff3b26fc344810bf7d0f7bedccff6feca654839036f1bN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5b27f8598726c5de474cfb0ecd5bb92a0
SHA16ecef3049521ff62643cce01a4d81f23ca285ca2
SHA25697b6f6867d07504f3224b765f9c1d218dfac1c5d70c906a9d8daaef75cccd08d
SHA51263fc97a15e179e4f02a6e81f8d5c2329a584d936ff43f6246c310733ed170d3a10442fdec59c50549f35ba45a15cc1380607a3f0e131824967de5cc331be8aec
-
Filesize
70KB
MD515f89a4dc41bfb82721e0ec61d4c271e
SHA1d51ebc70ea1fc0d127be3c563d7d71ee259b7323
SHA256c33162bd94b80dfe52eca2fbb57f3f601c2add8f9f8aa5ac8410acfc3b135fc8
SHA51243d2299c1f44a2aefbd277416c76053dbea06d1f4b74c742ec143f33b42d4742d8eef7ac8198f5eb71528dc146d8ae5d9690e42d7988631cfa0711377bb95948