Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 17:31
Behavioral task
behavioral1
Sample
3769142aa92878b2dd287315feec9ab0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3769142aa92878b2dd287315feec9ab0N.exe
Resource
win10v2004-20240709-en
General
-
Target
3769142aa92878b2dd287315feec9ab0N.exe
-
Size
22KB
-
MD5
3769142aa92878b2dd287315feec9ab0
-
SHA1
f37900a834f9b42e442a5f7af8063859f10fdd80
-
SHA256
c079b36dc070e1ecf426343a163ff8dff147acb24bc112a1f4c5403770d95125
-
SHA512
cf45d86bf714522390fc42b1d59263a20d313620447b7af273e88e86dd5f3eece89f1cc3d6ce275cf21830c549cd5e1af20071eed4635f109c6bbfc2d0fa39c7
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lzwAI:kBT37CPKKdJJTU3U2lz4
Malware Config
Signatures
-
Renames multiple (4026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2844-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233e1-2.dat upx behavioral2/files/0x0014000000022909-6.dat upx behavioral2/memory/2844-762-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp 3769142aa92878b2dd287315feec9ab0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp 3769142aa92878b2dd287315feec9ab0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3769142aa92878b2dd287315feec9ab0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD50ae82a2d7c8974e2e788da1612b591ec
SHA196e818926f69c1793ba35a9ecf679d61d87bcd19
SHA25614bc9bae1a3a65f3fce98d441783be89adc0bb44c64fccf5249682ef72a03de3
SHA512fc29e09bc15dcd14762eb4b858b2e1c65f1f69208d154d6a6eaa74a34ca4290a7044d5004d6f7eba43990701653332f93c530f5d63e2bf7bf495d5a7da3dd42d
-
Filesize
121KB
MD52d373e597b93aadedbcc14877d7b369a
SHA175f15b88cb7dc5d1c622ce12cf7a8ff9edf79469
SHA2566082b1044de75ace8e93dcf7b24a4261a8119459da0d165b72ca5887af6a83cf
SHA512ae435da43769f027acfa40b61e68d9bdd0a3bf5639fb553839cd9b8f1091b49539a04960179799fd98910f5b1e519173f5dbd9973f25afb44e60b66271c637ae