Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/10/2024, 21:34
Behavioral task
behavioral1
Sample
6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe
Resource
win10v2004-20241007-en
General
-
Target
6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe
-
Size
60KB
-
MD5
95b1e5564bac57605cc02961fc78e530
-
SHA1
8b9cd3697535c8083a9f6b4ebc31203b618316b4
-
SHA256
6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17d
-
SHA512
76be6770caf16b284f0adcfc9016eb51a99c93ddf39f546f51b8936ce4f54fde56a587328d829d2ea00f896b57675861443dae8fe1cc6f1b25220102852162a5
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8+g9VyjVyYJ9JR:KQSof
Malware Config
Signatures
-
Renames multiple (3258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0007000000012118-2.dat upx behavioral1/files/0x000200000001067f-6.dat upx behavioral1/memory/1732-75-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\HST.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\bin\java.exe.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe"C:\Users\Admin\AppData\Local\Temp\6dded0f03c0b4852fbf9b8de77e56833ab729f651312c189cad8cc1c1f55f17dN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5ce620bcfee2186252bd5c0072300d8fb
SHA10ce1ce7cf40c35176b2c3b7f884bc4fe7fe71eb9
SHA2562f93714a396014cd29d7118e578310d4ec50d36dd3570503fe4a537ea2739e77
SHA5126da6d7fa9151be6d7ae8cff43f32bc104b4ddc86d4ec67aab1538d8480f49af964ea3180b3de707f70626fa975ab26c0d229a23654510ed1a90aa4a938e745e6
-
Filesize
69KB
MD578b7005ccec34ce7a2307efc5d755d56
SHA1d1c6e6daf11844c23b4e9450c73397fdebd440ac
SHA2564d6ce511c83fa76c159de929e1f89c4d8d59ece0d630b54b7f6c0e0f7aa3be7e
SHA51219f8f929931567d10bffb33782e34645147f6e10b3bf3b026ce3b4677029fee6ff98555b7690c1103922eddc4e544df445cdad94b6769ece6fbf72dc8e5bb9ba