Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 09:05
Behavioral task
behavioral1
Sample
33a8da668103601848692927a5386720N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
33a8da668103601848692927a5386720N.exe
Resource
win10v2004-20240704-en
General
-
Target
33a8da668103601848692927a5386720N.exe
-
Size
142KB
-
MD5
33a8da668103601848692927a5386720
-
SHA1
ea7e113d3020f6360c3b0b6bc60ac209bf89ea77
-
SHA256
1120d26c0db3a0d60352aa9ed55afe65ae5cfe20448c55758150997b6ea3ee03
-
SHA512
e18026c283d8941e27a7bc8bec7fa8dd8a12324af80514d84af76eae898fc4b180915f08043741c1846c64062cdbb4d9e9038a1a3cd018bd13a92915432ad64f
-
SSDEEP
1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCK:+nymCAIuZAIuYSMjoqtMHfhfM3A86
Malware Config
Signatures
-
Renames multiple (4211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3228-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0007000000023256-2.dat upx behavioral2/files/0x0014000000022941-6.dat upx behavioral2/memory/3228-1508-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp 33a8da668103601848692927a5386720N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp 33a8da668103601848692927a5386720N.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD5684d1aa02fdd9ee19f7ba3d3569f3848
SHA13c7ed8ede95971f9d4813736290e0d5f2c837b55
SHA256665dc574a348cdf25a0ea22f290ff85f82d863b5bf11b2c2b480de467976b63f
SHA5125f90137105f90c5056223aec807baebbe5228c63fd6949483befaaff335bf9b7585f28e8cf7dfb8387a862102ae847888025cd113e992d4467692924869e2ba8
-
Filesize
241KB
MD54c6208b7026dce63cc7a4f277ba08f64
SHA185d5f67c0904e5313a39dd09177aaa510ccf0bb9
SHA25600bde7dfc4fa0f97412afb49714915a97261f3aedd331babc936b3d630ab16b3
SHA512ea515701302868b1fa14976dd735243bc039f3e96f6db606fcf2f3e7e743e8a77173d3844029c6507a62e1d40eeed79001ff245f48847c2b7b4d297ef0a46991