Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 02:27
Behavioral task
behavioral1
Sample
cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
Resource
win10v2004-20240426-en
General
-
Target
cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
-
Size
50KB
-
MD5
479dbf6afa8e08f8c1361693c1c7836a
-
SHA1
c4607cbaffba2aa78c44ceedb1dfbf2618e9fd8a
-
SHA256
cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51
-
SHA512
ea9f39494316ff9ee289c0f9e0cc6be9d10354efbb570460ef536e07edf13ba7b862254885955407468973dd76cf574e604acb77c0c28489744b97c925c08beb
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUs6iYid:KQSohsUs6iYid
Malware Config
Signatures
-
Renames multiple (5034) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x000800000002343b-2.dat UPX behavioral2/files/0x0007000000022959-6.dat UPX behavioral2/memory/3404-1096-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000800000002343b-2.dat upx behavioral2/files/0x0007000000022959-6.dat upx behavioral2/memory/3404-1096-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5bcb48739cbf7d10f0e74e64bcd99064f
SHA17c045575b274aa29182feae65360b62941b08762
SHA2565bb9272e9b1c822a4891f70328a9598b287f72876c4b0c4b7f0e06614099ab2c
SHA51227a20d7722198a3e8fca6aac6c0d3132e4a90cca48101c1c413a5d8711b9250ebebbf5d4b24a0ecc7c870a1e264d836fb0769454244a49a55a0552ae4c41c7ee
-
Filesize
149KB
MD58df21cd173740c04ea1d54f6e11ea921
SHA14cb4516f9bff932d345fe91c811b41c4446a8291
SHA256cd494bd40df27530d7539075fffc409040c72bae6c18059088cc12013486c39b
SHA512063e3acf9e9bc5c308006eb495411183150893572af5ec6efa7aceb40b9737c2759b44eb199ab2ab186a20a316d2b7f9269d44ff924a47636f9c930700a50329