Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe
Resource
win10v2004-20241007-en
General
-
Target
6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe
-
Size
57KB
-
MD5
55344a6d20e08105313c046901aab050
-
SHA1
d5b934d00089e98bddac0329b638fd6d5e97138d
-
SHA256
6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0
-
SHA512
c5f41d7aaabed63e333e793c1dbd69559dd4069156b61ee5f01247c89491a6b8a84ba6e3be236afc121b0fe77da7a63e4fd7a66b493f1ec70e96b29e61f98b0b
-
SSDEEP
384:GBt7Br5xjL9A7AgA71FbhvnIH2YsTKnKqtaW3WSVhYSinVtYSinVL:W7BlphA7pARFbhvOsTKnKqtdYSiHYSiV
Malware Config
Signatures
-
Renames multiple (3779) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jre7\lib\zi\WET.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe"C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD517c989a28acd1d76a96439adb9ad43b0
SHA115af7a1723e9be406ddb2f3de34ad8d18087a71f
SHA25655b65daeb932ab0eccbf3769a99482a551ab7d8f616d8924594279dd3537a311
SHA512a47b335a66434cd09e9ef8287b224bb61c2ee72eecd14caaa76a63bc9cf0dd8bc586af87648b9b1d84d8790de8faeeaa59fcdfef921ad04ffac94e48e03a0abd
-
Filesize
66KB
MD50e3ce169028deed045fd0c3d4a95fc7e
SHA127635089c2703ff8d8cc7ed0a6ff88f4b1316204
SHA256570366ebf1f075f19acb078e15cbc218b26e54ad180fa2571998a1afce25480f
SHA512406f9ee1a387392792e5346b844d310418ed11e2ab33607eb6a70b2d03e7aec5db4b1d7ed734e3a12dc1e6bc7d7d5d47ab48c3ed50019ba1ee087d8c25de596b