Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 12:45
Behavioral task
behavioral1
Sample
8fbbc4a843c9c854779fc215d1cc34e0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8fbbc4a843c9c854779fc215d1cc34e0N.exe
Resource
win10v2004-20240802-en
Errors
General
-
Target
8fbbc4a843c9c854779fc215d1cc34e0N.exe
-
Size
57KB
-
MD5
8fbbc4a843c9c854779fc215d1cc34e0
-
SHA1
5c302058036612771fd244aaacca94f59ed0372d
-
SHA256
fc28cd748741f8886b3321c97587ab0695f15dc4f37ad855cd1f034851ea3989
-
SHA512
35da8fa07e4d83ff3bec6c65352964e8fc297f747ef0a97dca4467bc0dbcb3c0373b34e3852df9ae5840b76b5652cfc42b04a9aa8d2ff1aa55d3973a32490703
-
SSDEEP
1536:V7Zf/FAxTWoJJB7LD2I2IHsLMzgGYJ5OngGYJ5OU:fny1tD33HsshBh6
Malware Config
Signatures
-
Renames multiple (815) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/984-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023455-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/984-1780-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\7-Zip\7z.exe.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\7-Zip\descript.ion.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp 8fbbc4a843c9c854779fc215d1cc34e0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8fbbc4a843c9c854779fc215d1cc34e0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5266648f11712e51f859e662b11f66e81
SHA1981952ced4e133877cc9505dd939c17db861c42e
SHA2568ae474582d1b075ba6318f0fe9696b3e4fb25c2bb91bb62da849b87cd64285a1
SHA512a9c527366e3eb928f78ac4f6fea010ba81ff36a9bbc2bd5bc6893da68365510dd1057f901dbd67c4df60d7b1ac26f1f2ef5e63601b38daccc652fb3d8f0737ea
-
Filesize
156KB
MD5ef10bab10a69a8e7ace85c3964d94b82
SHA1cef80ec63cfa5014eadf5ef370879d3a38a5f01e
SHA256764d934dbd16596399871fc9a34fc5e9edaf443c510c56b2fd23af21c93b583b
SHA5127becf68a2df6e03afed12d15eb3631090119e326ea951f67f641cdf551999d8d15562db8b98b19dc845677bebed6fb832101902c74a251e5417b44026c7d958b