Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 05:18
Behavioral task
behavioral1
Sample
630805d8200009bd71094b89a26c82f0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
630805d8200009bd71094b89a26c82f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
630805d8200009bd71094b89a26c82f0N.exe
-
Size
83KB
-
MD5
630805d8200009bd71094b89a26c82f0
-
SHA1
7075d78ea285cf2e80ebafae65784977b2b2ee1c
-
SHA256
233fe7bc23d5a67d58fb4235fbeac235e0d0247f865d94f49556615549c76d81
-
SHA512
826e00622c3e0c4605639f6b92b42eb9d1249f471e24c4e3d1703ce02d65678ff31a403d35892eef2f818a0e7e30892594840b98a3f9c41634438c08c071ac3d
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxyhy:fnyiQSoS
Malware Config
Signatures
-
Renames multiple (4541) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1660-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023458-2.dat upx behavioral2/files/0x0004000000022922-6.dat upx behavioral2/memory/1660-1806-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp 630805d8200009bd71094b89a26c82f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp 630805d8200009bd71094b89a26c82f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630805d8200009bd71094b89a26c82f0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5f74b3f1f63b024ccdefb0c6badf6e01e
SHA1542038c050009e14e4b492cfcac7f7b903dd4bb4
SHA256068274564812a5476a705edf542b54bfe44b0923f73c64ea397897defc38332d
SHA5121a4bcf8504a45513f220329eeeb5632205899fda36eb259a1200bdcd07315f534e8c8d8f430b563bdb5fa677acff6ee370ed5b87007d7898bcf9c3caadb7d06d
-
Filesize
182KB
MD55f2db74773ffabe13ca939f8dbc21de0
SHA162c1c8b95daf842426c057226e0a409f060fc993
SHA2565f3e75174a2c6e2db1e049c2d3a270c22a0ad52bffdd16c49200d4fc797a65e2
SHA512f6d49bcddc7c48bc9b71ad768c5fd96580cad1beea891bdcc457d2cddaf9d7a4bcee5ee5b22a17d7b768e8f67f2b7179eb5a88fff824b1f698ebdb223f8d1c76