Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe
Resource
win10v2004-20231215-en
General
-
Target
8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe
-
Size
342KB
-
MD5
d85a2e899c60a19e8170ed40d330ccbe
-
SHA1
9a9d011523d8a8a291e1e0a1ee0eb6c5459a081a
-
SHA256
ab4930d3748a2e5b849b06d70eddc8844de00f92bd0a1e6a212e38bfb82e5d6f
-
SHA512
a5cb7f0c0a849c32b25f48406623012443260f19dac2fca3df055ea5f256ba7d3f46b81e9f0e275622b2a912970de4f83924000d9aabab573269524c7d145a08
-
SSDEEP
6144:Ix2QdiglMFGfzIBeZO8Wf2cMRtCO/xZqqDLuz+4pQoL27aR9:IAQsgScEydtCJqnuq4z2mR9
Malware Config
Signatures
-
Detects command variations typically used by ransomware 14 IoCs
resource yara_rule behavioral2/memory/4704-0-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-1-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-2-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-3-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-4-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-6-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-8-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-9-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-19-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-20-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-275-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-1113-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-1748-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4704-1957-0x0000000000400000-0x0000000000463000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\desktop.ini 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\el-GR\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\available_for_trial.0i74s5s0w2nx.mf837gr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\es.txt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\sk.txt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\tt.txt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\available_for_trial.k1dfj7754u7872321e88fuj6712q1o9xr4582773605.4501c9w0hr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\available_for_trial.b4ax69ju4rbbn8e3sp1jnwq95l4h3d58a2afi34rk2w.4nxr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ObjectModel.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\available_for_trial.dg41ls8seu7ykxre6p6ud2kkzo33kcc.z3mq9r._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\dotnet\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\available_for_trial.6t422upg704a7nk5nz7q7hfo690384oomt943cj0mq0o.br._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\MSInfo\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Intrinsics.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsar.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipshe.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msado20.tlb 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\System\en-US\wab32res.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\ThirdPartyNotices.txt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\available_for_trial.y106kv393dahw4brhv1985o8v2m01k1i5b1s9i7b8v3b3779.kr8r._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\9d6ctr8oela4940syzz6r9j39g14769c.pp69wgpr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\available_for_trial.sge1xo41534v4m7c660j7x4mgvr0.o4wbpafpr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\available_for_trial.r0h8256x48592cxl7tygjpzxe91m8od1rj13phm.us79of8zr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\coreclr.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\available_for_trial.be9kuma5z34.4b8lxn9r._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clretwrc.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\available_for_trial.04r27brn6qbmynnxr47llled8jaslki14q92wis.4zeow7nr._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Thread.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\ShowGet.mhtml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\7bikc5a5i6b551gplvf4wzntiltmf01t.9r._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\available_for_trial.3elmq0luu67403g910opx4lww659i2jerfp4v1a.7j1zw8qi5r._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\LanguageModel\how_to_decrypt.hta 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\available_for_trial.cqbcw0777b7i32c.vpu2b4j85r._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Expressions.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\WriteMerge.bmp 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsen.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-filesystem-l1-1-0.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\hzr2gorxv28nq6l.kar._oUfpIt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\it.txt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msadomd28.tlb 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\mn.txt 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll 8b241c72853ac5e6293db79cd89563a01bfca7bfdb24b88381caa57e2ad84313.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\59rg216xx1w1xs8te37ws3m2s8242nxb4ogy2dvqnem.dobe9cg0fr._oUfpIt
Filesize2KB
MD5814818279de7afc0849bb119bc8b6a96
SHA155994cd2a5a62db7b7ec8efb397ff8f5772a4ffb
SHA2566d49f09c2a5241acf80978b85ff1474fa8168695da382f41fc66302905f1ab81
SHA5127af4a1c0a928e52a6f67a241b1346b881bfc2f6bac055b86fd8356f435a0e6bc52a74742f26bca77591957858f8671aadc9e225fcabdc4808460f2dd49e2ad64
-
Filesize
903B
MD52f0ea49999bbf1c5ce7ca4f041cc6d5f
SHA1ee304c36847acfd1f179b0851708778d8846517a
SHA256477a112b2c1acf70f54f1741693ba00ec66f4949e8c640ecfe5c38d7f94f2578
SHA5120a5a0375e8c97e925a07695ea5627fbfdc6b4b399c5fb68bc58c90ff9ab3ce04943ae2caea6b66ae2649bb5011cfa158c6cfea637d6f5f60e2c25575d03b0ff5
-
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordaccore_amd64_amd64_6.0.2523.51912.dll
Filesize1.3MB
MD5fcaac7a84b95ace6b2b984531710c6af
SHA1e749b273ccb8c6f5ad9ef695015a7779621ae96e
SHA256eefebcfbf015093535e3776fdd9187be11964b7d4b361119a97be238f62df425
SHA512fe56d2e9418ff6c01886c0485823980c4c42dcf65e84b0243e668dc2ed8b288ae7f563cacd73c4ec5f7b543217ff47fb7b43a54160a26b6865c8a89c06c924a6
-
Filesize
11KB
MD57c1cc0361298ec5b1dd2813274eb823f
SHA150ed91e825cb0f464a6db1edae34e589557105f1
SHA256b97e787f6d797ce07c05bac0bdc3591ae9b46ec8ab6cad7396a26ee31a664def
SHA512da2e15f3a08818860cb9c840f1443f49350f7505a3672765507029bb7a3bd8fa2b8fb6421029425721cf50dc4ba1d7b991544f92a039a7f57afc02fd7e7aebde
-
Filesize
82KB
MD581839fb2071b94389831df68cbb2f1b6
SHA176397eff58665ea5f4641fc0c04368da8069f91c
SHA2569ec76c212b3b2baf8e43fb4a90eaa6f83ec756259b88069ce22fd23d415cec9a
SHA51245f6ba0d40297c01f873530639151d5b5e0a438684483b5284f062ccba0b22c041ebdd79749b82b8f883163aa29490172e3cc45a2a241ba1c6e41e31482111d4