Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 15:41
Behavioral task
behavioral1
Sample
f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe
Resource
win10v2004-20241007-en
General
-
Target
f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe
-
Size
30KB
-
MD5
e5beed9c7e09d8c500ce7d31f4c7e290
-
SHA1
1bc991b045245b333d91a17efdfaf15f91ad2779
-
SHA256
f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0c
-
SHA512
a80c7e02004c337eb5a559548e2471651c7dbf34c197438134f42b378b782a21d031702d3220b3bd3fb8cca8ea6d78fadc78d48e49319e7dbdeda09f2f55b916
-
SSDEEP
768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeHhYU:CTWpN
Malware Config
Signatures
-
Renames multiple (3325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2380-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000b000000012029-2.dat upx behavioral1/files/0x000400000001043d-6.dat upx behavioral1/memory/2380-70-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\DVD Maker\OmdBase.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Mozilla Firefox\removed-files.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe"C:\Users\Admin\AppData\Local\Temp\f693a4347a42a951db49629c5e39c79763e3bc1bcb073902bb5d83bdebb5ff0cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD588d1d3afa94430def00af3b719be4d48
SHA1ef4f31c12a8e6c61ee7b8f3d6a6b9b06b551ca4b
SHA2566bdddfc8de1d9d9f46b5ff4d2a5c9ed04bca2dbb80f6acc58cd42a5a9035de30
SHA512c54258f56e497fe0eb25c3473b877b12a319882e1f469a0e21d49f4d83700fe6ae56b2803ac22575be07dad83c3080724bc5859c5e62dbac07d7f816a480e469
-
Filesize
39KB
MD52e8b82fb13804621bee2d544d3a618e3
SHA12e3148abbb33eb37d04f174f94ac467dd2691444
SHA25697c1b66d1adbf20e1220960a49e8d2010066d43fe9b9a17f3d518dccefecf46b
SHA512238285fded52fb9e7702400b8e44e0156a74523f2336cb210100067c8cf1acb3583927f268a63a081b8ba8e6503e034fffe137f99b0fa45b46ff7f3af32d6ef4