Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe
-
Size
60KB
-
MD5
d686035c9e0b578475f94ab971322ffa
-
SHA1
fff6b12da5fd0f6fa3d0a1522d9c1fb61933bcb3
-
SHA256
4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b
-
SHA512
8bb03859d4b40aea71c9093400e413dcc694b7c186cfdb35b561991c2a469f414d4141c5f2dd05c5d40a9e95cf49ddd24947a3960f3d176015012d8e4c4ec637
-
SSDEEP
1536:W7ZppApAT9mZ/D5zf6ydyf+abMkF24kzK3jbrCkoRWNkzZ/D5zf6ydyf+abMkF2G:6pWpa9mZ/D5zf6ydyf+abMkF24kzK3jd
Score
9/10
Malware Config
Signatures
-
Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp 4603284463f091a4bcac84e438392bb9909bf85115549b13da8dc98ca749fd3b.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD55d8379deb8639c815b3ab8ad15e06650
SHA119141f605c44650cbd5092b4c358a7ba02938a86
SHA256af9e022f86ab7945be0490342b39e47eba8b6165609b1c7b5fdb4c2b766eb5d5
SHA512d44ee9758f2aba910ebc8e960b894829387fc82f87b98a885e4afeff5681341c51a8dfa09b96f637cbda3a9def606c4d5b4704aa0c89634897eeaf420c67cf67
-
Filesize
159KB
MD54276ce4f20b891df4be2f9130987bdd9
SHA112c9887057588d01e1be2408e4a745de41d89991
SHA25669c7fa699eb3e061533854eef46ad966c726b05e7d9f6327e71a7c8230c7f697
SHA512b2c24505e90d8612033ad44899f7ba34b0a655b253ca95262a6699aac63c8dad98efa75022a935b26703b6a451e8d03b078d8873e5e92cdb4ce93479cefb8167