Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 22:10
Behavioral task
behavioral1
Sample
5edd1d2fc7d6e26330276823a57937b0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5edd1d2fc7d6e26330276823a57937b0N.exe
Resource
win10v2004-20240709-en
General
-
Target
5edd1d2fc7d6e26330276823a57937b0N.exe
-
Size
460KB
-
MD5
5edd1d2fc7d6e26330276823a57937b0
-
SHA1
59147e8871beb0a5a219855d2db9a5d4e3d34cb2
-
SHA256
15d309141ca995ed2f3bce4a1670126b30e96f5b1c670ccaf8a0a837235d34fb
-
SHA512
32c4e3761a312da70236792ba65267f9ff7502e47e245a981f19eaaed54f1097a12dec82bfb7f2602f84135eebd47bde0e05f635694ad72f41f7936f95589975
-
SSDEEP
12288:VQtxgNUhiHOR4LucvSFSrux88ndNtJXzLFziN:VI8UhiHOeE8rin3thLu
Malware Config
Signatures
-
Renames multiple (2507) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/5108-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002346a-2.dat upx behavioral2/files/0x001400000002291a-7.dat upx behavioral2/memory/5108-1248-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ca.pak.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\AddRemove.rle.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ru.pak.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\CompleteCopy.docx.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sk.pak.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lt.pak.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 5edd1d2fc7d6e26330276823a57937b0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5edd1d2fc7d6e26330276823a57937b0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD5e0ac684e44ac26bb328fa5442f7fe72c
SHA17e166778650c513adfeb5085e7ced469d664d44a
SHA256bfdb9d653c4498af3be79f9f6f539ddfedc8cded3f2a2fa783883029b0e94532
SHA512d9a303b8fac446aa514382771a8765f0f1840d47d3721d168f3f4b902157302a2def5782536a5b3dcd90677fca0f2374e19e45845d04941a900b20ed9fb5326c
-
Filesize
559KB
MD5e3f360ad00784b1a24646018e796b077
SHA10f7d3920eeb4d35228a8a60e6e070e95df026259
SHA256547b324461843af51bf7f60eff4054aa6740f0e18841b5dda55b34fcd46d4c81
SHA512dfbf0e392bdcbc4b2b1a00b66b904a11769a3227608c3596874c33fe6025aceb37a8f892f7a9ce40694d3fee758fd825ee442d8047a8cb54dbfcc62653d16c05