Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/10/2024, 23:29
Behavioral task
behavioral1
Sample
7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe
Resource
win10v2004-20241007-en
General
-
Target
7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe
-
Size
31KB
-
MD5
bfe08c2fb7c1bd874509fdf74d9e8d06
-
SHA1
04068d5d000d06fb956afd2bb6cf6d5047211cb7
-
SHA256
7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608
-
SHA512
2d3aedc70dd2044d34d8ce9d4655044389f8728633f1565e558abb27fe067104933dc194b5e6e0ac93c552edffbda78e57a545e594c7e286ecd366143907984d
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Y9LlGlK:CTW7JJ7TQlGlK
Malware Config
Signatures
-
Renames multiple (3513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1668-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000c000000012263-2.dat upx behavioral1/files/0x0005000000010479-6.dat upx behavioral1/memory/1668-69-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\JP2KLib.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\picturePuzzle.css.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe File created C:\Program Files\Internet Explorer\iedvtool.dll.tmp 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe"C:\Users\Admin\AppData\Local\Temp\7546069fc42a756cde82606b31a196cf236d1a6aed90fa6289afbcb8a1b1a608.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5183ee78090f8863369616e540a8537e5
SHA11093c7d5560118381717a4d15be8c9ad99d4b162
SHA2565a9799980eb5e3a96e6f2244366615ad45e8ea80bfa9def9141dd0c49feec544
SHA512d41737bd020320e7e4e45965a6ccb905d7d36f511270a8c8f2d15f8756f9bf85a170429d31d3bb74d15aa87f5fbe80cd8695bff4725414a8b31d2c6035eb6c40
-
Filesize
41KB
MD5505413d61c280a7e2de7de0f623075af
SHA172cec4e2f544d9be059078efbbf3e1e1063278b0
SHA25608e8a2620940bd42101dd3df881b66485cefe09921da491e33bd71f9083d781c
SHA5129a3a48680d80d10c9f96ea71cc16fa1285c64a2dc896752d30610e71a5fa8f55fa2da4543da72046b751abda429ff938335db94b9a31505a7127f3ee6664803c