Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 06:06
Behavioral task
behavioral1
Sample
93d610e7e1d76c117133a4d12cca9c40N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
93d610e7e1d76c117133a4d12cca9c40N.exe
Resource
win10v2004-20240802-en
General
-
Target
93d610e7e1d76c117133a4d12cca9c40N.exe
-
Size
65KB
-
MD5
93d610e7e1d76c117133a4d12cca9c40
-
SHA1
f7b6af00c34e0c5cca79469a1dac6dfa2c464553
-
SHA256
5dc0c2674b7df8659f964533efad60d02cd360f72f20c5eb32cd94b99205ddc6
-
SHA512
1edaff9e04c9414c99cb4f27e88ecfdd15b89a0ea2e1fc3e83ee9d9836f6433ba39e59ad3ee4a0ace46562dab5fb94331b2984a0c2a14907c56d4006b837ce5e
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDr:KQSodYeHNmkDr
Malware Config
Signatures
-
Renames multiple (4574) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023564-2.dat upx behavioral2/files/0x000600000001690a-6.dat upx behavioral2/memory/5032-1106-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\libGLESv2.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 93d610e7e1d76c117133a4d12cca9c40N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93d610e7e1d76c117133a4d12cca9c40N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93d610e7e1d76c117133a4d12cca9c40N.exe"C:\Users\Admin\AppData\Local\Temp\93d610e7e1d76c117133a4d12cca9c40N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:81⤵PID:1708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5fc5d33ba0129ce4f0f62225222d3247a
SHA122080cab0fa02ce041c3f1a9b7d5a5f505773500
SHA2566587e4830181d73784c1746db69b71fc07ba48b8d99948dd9c90b660d89790e0
SHA512ec3e820f68486b930aa5beac64dd22dc7c7db36d9a0627325dce80c2cd3325c5686c2cef1b0277063f351628ad4240a8d1da592e1eed519360914d711c3ec8d3
-
Filesize
177KB
MD5bc8e945f980592b1307bd42a140215f9
SHA103a8a527bf90692d367d9f39501fb8d6277d3d9b
SHA25655a62fb1e86eafb4d24027b919398127ff0043a552a9ea7bd22e1f652d6cb29c
SHA5122c4ed2153a87347a37fff09d682c22d390f898071fed07be1aef463e60a37a62f07000858acab39b665411608aa30ce4a1fd5be9ef49953e87dfe7b072c5d337