Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
Resource
win10v2004-20240412-en
General
-
Target
4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
-
Size
92KB
-
MD5
d11bdc6c66fff44d794f6fe9400fba8e
-
SHA1
d35b8e17c569acffda4db65b8e89f7ac01516470
-
SHA256
4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179
-
SHA512
d2e7dfe82b3928a80969ff45282e350ec80629ea00df0afb43efe9411f4aaf22dc46e45ad3dbbee627986d5ae7a96c28a11e728a489e8e6ca574f917339dc979
-
SSDEEP
1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNw:6rWpcOPxPke+e3fFpsJOfFpsJbgEK
Malware Config
Signatures
-
Renames multiple (5035) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp 4c7ef0d301d9e8a37cfdc4901680b271c1260db0c4c23339912103f10cb37179.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD58659b3a0b085da50ec45727c0fdfd834
SHA136ff2b5b8d4a218b216a8d1700107954c8c7a00d
SHA2563574629ac6d8c2113a8a8bb1403db5cd7ef8ebb9ff479ef4b03c2765aa1d7326
SHA512a47ba6bb313e7591b506ea7ce91ca2f240c268c07c52f462a970e769b338ae2e70e1cd971d352e9ec2f4d1b6f2baf8875dc2bbe4d5f7e7dd0c9e19974a7fafc7
-
Filesize
191KB
MD5d09e97a321bd7168e668b0c8c05c4863
SHA1b4a6e5ae354147d25c0ae252218147e9792e2786
SHA25669f5b5e04ea8e44c7201a6c81f2172b32e1efefd97937fd2d49c4215feb14019
SHA512b9bdad3e42e51e8e1dcf5e04a2b810d17b37dde0d4a6218588d88adf9844f2dac780124e5276ddad9829efb21e2a938c476375defc7464112fdbb2ffca0f1065