Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe
Resource
win10v2004-20240704-en
General
-
Target
e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe
-
Size
47KB
-
MD5
c0ae79c9ad6d34f4097303c53db409ae
-
SHA1
9845e0a1be0ccd9bd6b47ae58df07ee4a1ef465d
-
SHA256
e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5
-
SHA512
17ffbfc20cc744cd28624649e74f09de290dabc05d5b03a988aeac5a335bc36aaa3ec707fb0a2c5cfbccfaf9af1663ceb0e52adf0191fd20d702222a768e8fb8
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfpVF/MF/3Nw/Nwk0ifxRfxSqAJPqAJz:W7ZppApBULcfpHLcfpX2/Nw/Nw8fxRfG
Malware Config
Signatures
-
Renames multiple (5250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\InvokeSelect.wpl.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\vcruntime140.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe"C:\Users\Admin\AppData\Local\Temp\e9385906cc5aea7fd5b55ae0aeaeeddde3a600271218d914f6486395bcb5a6e5.exe"1⤵
- Drops file in Program Files directory
PID:2052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,7761714625659357865,10802238739796857379,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:81⤵PID:1824
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD576fb93b09445a797351afb37b63940e5
SHA117bb04274818f43d0a752d11a326f914b80d398e
SHA25612b8284bb6d346982cfd37218c545fc6589582512cda7b2dbb7f9a5b98d17d60
SHA512fa92b783927b4bf73b459ae0a485d0059b30cb96b68ef50a085c52cba9ff60eadbeae33bc733134c58d5ecebfd5ff7aa76c305c9e101159e81b17cf16354c50c
-
Filesize
160KB
MD5d941883a11cf665beee9b71a7cb8a9bb
SHA12fcfb512a2356b38f534807bb0432cce79a44b00
SHA25679aa5e74429d10fd399f446dd10895d397a8986d4db8ee8fca69588429d32f55
SHA512a0671c7a27d14372968a6d013ad92e6eec810a7d54600f61d8b685124a650cd8ee695ce2d77fa0e00c13c2677ab798e3f4faa4ef42850814b6e10a55f432e510