Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 04:11
Behavioral task
behavioral1
Sample
a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe
Resource
win10v2004-20241007-en
General
-
Target
a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe
-
Size
38KB
-
MD5
91f5c514f76e87a591dc6f6616db8a50
-
SHA1
5695a4aee8714beff15fde04e3c526db6f178be0
-
SHA256
a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022
-
SHA512
7635829f56f8ef61e43a0462769ce84800bbbdaea7ce06e4b1d51b0be92fb9a45bf02b7ed030f157875db0c562b9fb3c404608b65161a1ad7ac481c8c1e2337d
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PIJ99J9v:CTW7JJZENTBHfiPIJ99J9v
Malware Config
Signatures
-
Renames multiple (4093) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2120-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000900000001225f-2.dat upx behavioral1/files/0x0002000000010620-6.dat upx behavioral1/memory/2120-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Mozilla Firefox\platform.ini.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Journal\NBMapTIP.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\ConvertWait.rle.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\NETWORK.INF.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-loaders.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\PREVIEW.GIF.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\THMBNAIL.PNG.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe"C:\Users\Admin\AppData\Local\Temp\a22a00f20241bce38b3ebf765bbd63b2e88b9bedc21f848f4117dcd76b58a022N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD585e0c980bb16d7cacf5a3f196d21d5bc
SHA1ef292b1974f3f60f92e9ece373be4290bf6e128f
SHA2562cb6975f8cd6af8913cfc4d64b53a3e1f53c0aa502f4284e6c0c11347ac3c0ad
SHA51216c6ce40bae1553de84be069b55826b3e674096d4dd65fa2e64666369a672b749bf9069757e8f62ff8642eb78fa336343debf8260cde028f15838cbae2160989
-
Filesize
47KB
MD524d119ba971f596d89c2b9e30da60632
SHA1f21d46ae56d2651fee1c5713aa0411a38cff29bc
SHA2566428f0f079bd36fd3e0f0a6ec13e0651d2992a3018450e0d835ec78591619c6f
SHA512ed11c36d493d075b2765f4b1a70e2745b86b5b37764a7551b16d3ed955902968db40dbd1941fd1a8f22137b52a513e1db7d405566420edb04a7037f13d58cfce