Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe
-
Size
146KB
-
MD5
e3c361bb249153b3cb0e4fd990ef5840
-
SHA1
df672d0a42357791313b2c0e516924f19b3dbae2
-
SHA256
1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1e
-
SHA512
599d798a28dd1a43a585e642fb10a3997ff1914b1b536eb57983b6857220703d45e83580c2796e417e54c1bbe43e68dd52247ea0c958423aa6fa31e91f10e58f
-
SSDEEP
1536:W7ZDpApYbWjIoPyPoLzV7c6Sh1XtkkkkkkkkkuC+2fraAmtQHyiNueOyAB5+0YJb:6DWpAoOhQSicJgyybxYm
Score
9/10
Malware Config
Signatures
-
Renames multiple (2854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\jsse.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe"C:\Users\Admin\AppData\Local\Temp\1e1c2668ee7fe86862d4c87d4790626c93915a54891d832529f45724901f0b1eN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146KB
MD57d6453806a5809e52c39fe7469f7aa34
SHA19ed89ec6d740d511bfc3be7446f24a1edd428e2f
SHA256887d6f43ec631845386234feb3e34117555556b67c88d8131311878de3b04e75
SHA5127ae5967de456a7dfc193885fa4baee55ca0f24c3952f4a18dbebfd6b98dee0bab066b2e653981bb11b9513a9f54cb7ddec1d6fab429b3b895436c5cef3b0e0b7
-
Filesize
155KB
MD58f2c829dd1d60677306ed09065b8ab50
SHA19068a662e84fd53c427ae1d9700cf88344968662
SHA25690a16d968028fb367d59f4f253a3ce48fd6e3f1898e52775b8e5ddcd3e995a06
SHA512eabb024f4061c1efb6bce8d14579f758ebca4815d84cfd347aa4598fabb63b020ade448e9eb9df90d7b1fe9a38f8f39aacf83b3cf23b8f29e476e449f63b6df7