Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe
-
Size
45KB
-
MD5
87ffab747657202b841361ab7eb7d982
-
SHA1
06355b2b6aa8a346d7697f7fe3bf55aa267eaf4b
-
SHA256
00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4
-
SHA512
195ef9219e4c9641b4ec232cdba84fcaa6045c0afc9a4773de86ab49773ac2e30e433120b8b71b73eb77c227a37e12dac68ae29384bbcc9cd34644b225475abf
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFAHssMzMss7sxyZsTZX:W7BlpNLpARFbhblkYlkuvIYFdHYyld
Score
9/10
Malware Config
Signatures
-
Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\MergeReset.ADTS.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_elf.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 00839d3de738609935e950b097327d26280698ec2550c08b8e1b633fdb4563d4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD55e5bce593c6530f5f1cd4c9b667d2520
SHA1f095a425c1a3fc3c6baa37f4b1633eb088ac302c
SHA25671bcbd10f07413a97cc2ef2d1122f4c9bec04507c70ed19f9eae09216f2d6225
SHA51237650ed44c0d6ddab910c4e1cbb0532ff1f269f029fe690bd725fef41ecff32edcfa6f34c4cdee4dc4c485693feb7560ee6ab95f4bb285b1e9be020953d2e552
-
Filesize
144KB
MD592d628c74e4f20cdb06462d63be73a55
SHA1185be04d4afc5bbbfc0e26671994478a8bdc6c6e
SHA256ca8d5c2dbdc996146f5c25bd2bdbd20d5e61c2e55352ef74a0999b493babf370
SHA5122525ae0e621f7233b2c63aa51bf7e96b694be952249fcbe031dbfc7150a0314c140ece031171f4fa4ebd7750fb1f59632ce99fbc8b68ef20dabdf7526957928c