Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 04:04
Behavioral task
behavioral1
Sample
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
Resource
win10v2004-20241007-en
General
-
Target
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
-
Size
53KB
-
MD5
880740c22dfe4bf33f150712f1a7b0db
-
SHA1
300fb3138f837edcb60fbff674a4630af9d359f3
-
SHA256
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe
-
SHA512
ef9d7f03df2bd3b399e37168b143c91a241b68f0c4f797877360c1b8ff25af4ddf09f45696ca0b452faa39cb52f3cc619fb30204e4d5453d6e7205ffc4f1ffa6
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9X:V7Zf/FAxTWoJJ7TJ
Malware Config
Signatures
-
Renames multiple (3760) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c00000001226a-2.dat upx behavioral1/files/0x0002000000010674-6.dat upx behavioral1/memory/2536-70-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\ResetInvoke.wmf.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\end_review.gif.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe"C:\Users\Admin\AppData\Local\Temp\ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5fa7c13aef2eac56afbdde3ec6944a70c
SHA1dc212610fbee50628d3586e48dcb101bcbf00e29
SHA256f5b108b95cdc169166ddc08154e9c9f6acfe0b9c5fba557a8ba7aaddcfba1c1e
SHA512b3f9475b6283212cceb2612a89ab6127c6a64bfc60bb9beed8d6f7eab2887f491f18d540cc3db78823ebdb74b7e87ca17d73ce80767d33b798bcd3c672ffa5ee
-
Filesize
62KB
MD51dc6c54c2b65619d1878617d0c1ace96
SHA1ac0bf2621861d60c3c74bc298923d5e2862fc0db
SHA25658cad1e774088f23e89d6d5414b09c4a6d7a754b97fc9494e2b8c4da60ad99a0
SHA512abb5a023cc3d5816ba816eecc0c7f4876449dee83987968c2769a2fecaef0405259ec7de9fcf23c2e1fd3c199e77d06a942476fe8e02872f5f44b38222fdd1e1