Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
e74f1eb6dba0ab993e093bf224785030N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e74f1eb6dba0ab993e093bf224785030N.exe
Resource
win10v2004-20240802-en
General
-
Target
e74f1eb6dba0ab993e093bf224785030N.exe
-
Size
45KB
-
MD5
e74f1eb6dba0ab993e093bf224785030
-
SHA1
dfb16b82d1df25a3e70f15be268ae3d1aea2c363
-
SHA256
8e8eac68b4345bc8a2a6d50ecd943bc82c8c87ede4e6092f08368c6fc2b82336
-
SHA512
aaca869de26d2deec09d8fff7ad529f76120015a751c5124b23bf60900d34458454b487f446f1e8738e3d8326cbc6cbdb767ecd0f90307f4cde46ee191e7ef6e
-
SSDEEP
768:W7BlpppARFbhjbhQYjYY4F2j3TK54F2j3TKdDa:W7ZppApB1W5WdDa
Malware Config
Signatures
-
Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp e74f1eb6dba0ab993e093bf224785030N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp e74f1eb6dba0ab993e093bf224785030N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e74f1eb6dba0ab993e093bf224785030N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5000b1f289a01aa58843be9110260e33b
SHA13575ddf74cff7d4146bbbcd5e7000c5857db490a
SHA25683eaf58d600a4db0d0762c66eb54e93f188e742a735dca84dc330e2ccd09102c
SHA512aea2fc568abadfe9dedca2af52d2b807598182d8439e32e93eb7e1a92b95c62622d1fe51a284c5869b2d9dbe73a5932ed4285c8513e68441bb5e7c60643841c4
-
Filesize
145KB
MD5997bf97ed911c76369f4b254b8054d6f
SHA1430b2e627f6a69ac49f49bdb1049df7b1d199586
SHA2562512fe75f0428cb6a1ce8ed3adbc32eac77a62c998d4dbae61f621bd38d18361
SHA512e2df7e96d1b488e1fc1d4f8507d41d4126351dbe5b34767a83f606b5ece15cd0f5b2433a5f1759c8523fe293d33ed771fff6435061ac5471686933aae7aeccff