Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 01:08 UTC
Behavioral task
behavioral1
Sample
a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe
Resource
win10v2004-20240426-en
General
-
Target
a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe
-
Size
165KB
-
MD5
82aa132a94d3d8439cdd950fefa887df
-
SHA1
13a3ad819ede8226df4184f120f2c1dee3349c4d
-
SHA256
a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b
-
SHA512
43eafc0a9faa87d6c587211cfe5dd54e3ab752e94f5cd16d2ebaf22442727d0eca2addbd0cfeaacd3701e22fbe120c104990e2ef511c80a0c8d3ba860eb07417
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJBn:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuX
Malware Config
Signatures
-
Renames multiple (4684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/4040-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral2/files/0x0006000000023288-2.dat UPX behavioral2/files/0x0007000000022959-6.dat UPX behavioral2/memory/4040-856-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4040-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0006000000023288-2.dat upx behavioral2/files/0x0007000000022959-6.dat upx behavioral2/memory/4040-856-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fr.pak.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp a2a31091ff9d017223dc961a64fa2d2b07b560b5fce5e7c4376437934089c82b.exe
Processes
Network
-
Remote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request145.83.221.88.in-addr.arpaIN PTRResponse145.83.221.88.in-addr.arpaIN PTRa88-221-83-145deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request203.107.17.2.in-addr.arpaIN PTRResponse203.107.17.2.in-addr.arpaIN PTRa2-17-107-203deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
217.106.137.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
145.83.221.88.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
203.107.17.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD5f501eea108fa2b8c222a3d8bf621b35c
SHA18e73f1cd50404308a006c456d6b5735de33b15ba
SHA256dff62c726af43229a668130b57435a85d79ba6b676a1219ed6af2e2f4831d2aa
SHA512d6d2b013d57b452b53f3c19c540d2bb2bad9b016a827480dd935f598e805adfe435e5930f17545fcbfa6433bfbc1b88b0b33587b9033c35511d07c9e38577c3a
-
Filesize
264KB
MD59073ce1a33fcb568bf1dd2791794d883
SHA1c356475d0cb5086be304469f47a361fc574e43e0
SHA256bace856dc83a37d28b7a244f48ec4b41af0e7ab01c2b468315ab5a5fcfa08e52
SHA512d58be9707c7832f2d1be346eead1a38f50a00f134058d843d3ef2bd731a0e9f5451e4cbafe25ceb71bb17606deaf5d976b4c73cd7101f046093229f2385777e9