Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2024, 02:30
Behavioral task
behavioral1
Sample
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
Resource
win10v2004-20240802-en
General
-
Target
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
-
Size
57KB
-
MD5
9e489e78a1f1616b6d60dfa94ff00ee8
-
SHA1
3966f5764b212c0f36a64a1ff95cdd324abdcda9
-
SHA256
beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c
-
SHA512
7b632a8d396dccecf442347e82a38df8360f3fe9c2c07b78f41de2144fff6cb4782ad50afdfee550818a11cddc13b5e920d37f11a200816bde8ba1b611e7a02d
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rA:V7Zf/FAxTWtnc
Malware Config
Signatures
-
Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1160-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002343b-2.dat upx behavioral2/files/0x000c0000000220a6-6.dat upx behavioral2/memory/1160-1884-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\ImportRepair.mpeg2.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe"C:\Users\Admin\AppData\Local\Temp\beff42f2f2e8bd7ec7af53cddc659e54943ed850359f13e4fa0bdb558644912c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5e211c9a39b36e748df8803c3a05359d4
SHA108b18525894068a8c64c00d7e59ef13b3b059651
SHA2562bc6e9343befdad4951719eae52ca01a41852c0c40379636c0a71b9f228877fa
SHA51219c65edbc865f249d1c6f46f041d12d07c723c7e9d19adf794fe7ff5ab9e449a8f72932e4eebe8130062f0f31e94d5248a587548214e16e97d778ee0534690cb
-
Filesize
156KB
MD58b7616e10ed9866b7382e7b8d148e280
SHA1a50ac683958dfee78e03f42557592ba3f3f4d438
SHA25641943096475ba738921d23aeb3ee1279506a9328b1752525a02ef7da6dac6568
SHA512bfe7ed24bb7361e8257b7f6b087cbd60dada23d6460033f0fdeb54c273a82edd9614263032cf45f50bd879218116dc9bcf3bc372e1fe9905e565791f3556d51d