Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 18:21
Behavioral task
behavioral1
Sample
3e1d94878f4a459a8d537d922a0c42a0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3e1d94878f4a459a8d537d922a0c42a0N.exe
Resource
win10v2004-20240709-en
General
-
Target
3e1d94878f4a459a8d537d922a0c42a0N.exe
-
Size
50KB
-
MD5
3e1d94878f4a459a8d537d922a0c42a0
-
SHA1
ccb905c9d5a6acab7ab7f9b37299b60282913a3b
-
SHA256
7bd0c39e8d19fa5fdf75707e61b7d1ea0d189648fff66e1888507cf0c361e28e
-
SHA512
3b982f7ef0cd1e6d72f7d3683f41ce6b26b9e2c680ad896f82263595ab0830bfa9250591cdaa0c8c9a9057e0540a848b94540dcad00e3b54a887ed677a13a0f6
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyIHAJvHAJLMF7:V7Zf/FAxTWoJJZENTNy37
Malware Config
Signatures
-
Renames multiple (4118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3680-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002345d-2.dat upx behavioral2/files/0x000600000001e5db-6.dat upx behavioral2/memory/3680-1786-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ko.pak.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\AssertDebug.xls.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sk.pak.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp 3e1d94878f4a459a8d537d922a0c42a0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e1d94878f4a459a8d537d922a0c42a0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5ce1bd8d0b38793620a6026cf8e22c948
SHA188eb8f5a4ffffc7a291bb8dcdd42f8802df68b53
SHA2560cc586fb9316e2cff1de52a5337a5f19040a1322f8d77b5aa1c8cc4e1c25b863
SHA512db5a050c6f170f06da32af5913f5246391ee3fbb7632a385b59fc46d2274e4b71412b4d805fa37271860888d4163a673281dfe540e4a325159e505d0c5c2a70d
-
Filesize
149KB
MD57d8f4ce927b73db4d3747d3f65c52517
SHA1512ba7399653839a8eea5264e65b05150eb217f1
SHA256bf7d8983007b86b607ef187f2db55c379a51cdd048c3a968cdf60b62fe4a7f37
SHA51263961207ee09f98500f409074500915b9658ea34d84f8d04c3fb99e4201188a86189e4e5ee4f41a54c297503b499130bb92af3cda8742322970d804574f48815