Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/10/2024, 00:05
Behavioral task
behavioral1
Sample
835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe
Resource
win10v2004-20241007-en
General
-
Target
835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe
-
Size
102KB
-
MD5
2c31f3aad5d32b6e33c690916ab9afd0
-
SHA1
6f74a694c3aa950e6f552166fa79cd07afbf5ce5
-
SHA256
835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4
-
SHA512
971f9ac8ae500dce074ebf9e6b8f5b7d37bb94ebd88cfd552cb510770a0939c1795da9bb9b1e4ab3193e6ac8f249bf9a36b8597e20b15318a1871692ebe43a27
-
SSDEEP
1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8zxY51lnls:enaypQSox51FO
Malware Config
Signatures
-
Renames multiple (3449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a00000001202a-2.dat upx behavioral1/files/0x000c000000010546-6.dat upx behavioral1/memory/2100-62-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\lib\management\snmp.acl.template.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\bin\kinit.exe.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Mozilla Firefox\softokn3.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Windows Defender\MpCommu.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jre7\lib\flavormap.properties.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe"C:\Users\Admin\AppData\Local\Temp\835a558aa56d87ef242c67e8e52ae44f56f4b50193af08d839437feb44137df4.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD58109e94a6fa3615714644bdf83ba8410
SHA1f48e003688d81e9fd4649e658abbccc2d155febe
SHA2566fe288bedbb5504dc5552d27c7c938c820778a445b9b601164705e154614a7cd
SHA512291ca03cd759c1aa6df315ba233346145d32abb4aca7bd87435ba7bd8766288edc2f7d086e80d84ae822e5025aa379064757c2442071f881c695039534330ca4
-
Filesize
112KB
MD5c09e5b35e8ddb89be0878f5589c79514
SHA127436d2e0de5514566ce705e9c5f86af2315ea80
SHA2567f7cc1c69db0e53f53a65f85a43aa560a0b9e888b94b8884ffbe4fd3ec736f0b
SHA512b83ec0fdda8613ef7a4fd0c75841cfaf3acc2dbf09ed546e1d56b5639940dfc5b04bf26fedfca3c7232c9352c2b513f0611068dbfe245dc7889d86b7a839a489