Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/08/2024, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe
Resource
win10v2004-20240802-en
General
-
Target
a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe
-
Size
49KB
-
MD5
1b711a56391107a89fa68f5d1497df28
-
SHA1
6b39709bb9672e8c20616a3baa8a2813dc93012a
-
SHA256
a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6
-
SHA512
b41b04ab1e95cb21eca2cdaa97084fe471d11a335bdff16b26fe81c5ab864abf96aea297d10fadf33e269be6500128e56356cdf277c2c17dfcdf429e3fcdb82f
-
SSDEEP
384:GBt7Br5xjL9AgA71FbhvuNBNKVkVYlIAItCCIntkntV/h:W7BlpppARFbhFAxC7ntkntV/h
Malware Config
Signatures
-
Renames multiple (5211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe"C:\Users\Admin\AppData\Local\Temp\a415fdc20adb8bfa56a0388bbaaa9d2d5c5d342e2446a76e1ca6816cd9fcf3f6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD55c4547d638c5cbe620d7866e43831210
SHA11aa4d668f736e8cb74ffe0ccf104232e64d6ec70
SHA256cf2b3d07729abb1bc7f99dfaf108ebf083116cde3401b0ee6d40d28f65e6d997
SHA5127d6f0cd652ed2b623c16161a74f557259b8754c0922739ea828686eb7b0ba2cc3c65977bf766428b072fc2056c6824b2f9c03a0acfd9cbeb315f8c55b21e72de
-
Filesize
148KB
MD5fd9ead52afd2ed37f9bbeaaf4decd8c2
SHA198429ea0cbfe535b8e72dd7e4a885f1b246b2c1e
SHA256cfca10d1d89e7f0b6f41f2262bfd09298583e78c5a5649be22f5babcab93d71f
SHA51273ad6b5d5d97377c0c1f978133bcdd60fc3cabbc5aad424685ef7d2b82e64ff4ad241d636244f97172c325efd2bf617ec95885278bebfc44850aab03ac60d231