Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 09:40
Behavioral task
behavioral1
Sample
79d7816c74a3c3e651ac0bd5a8756390N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
79d7816c74a3c3e651ac0bd5a8756390N.exe
Resource
win10v2004-20240802-en
General
-
Target
79d7816c74a3c3e651ac0bd5a8756390N.exe
-
Size
71KB
-
MD5
79d7816c74a3c3e651ac0bd5a8756390
-
SHA1
f8605de38588333619097501c6f659fe2d23c2ca
-
SHA256
38b1ac3e9f8db8c0bf5138c676dab8898f21859e45ddfc9353f66f10ba00e6d9
-
SHA512
d3e27e1be552b156b1328723599617c62160787603c0fb7ce1ba3cf67eebfd92b415e55f805ab07069b57a180bf4660f8b237ce21ebc65fc82a40850ff6f10f8
-
SSDEEP
1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCIqwq+:enaypQSosk7Nz
Malware Config
Signatures
-
Renames multiple (4617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4292-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023424-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/4292-865-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 79d7816c74a3c3e651ac0bd5a8756390N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79d7816c74a3c3e651ac0bd5a8756390N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD51c2217f9a7f1a2e4ddd3820664f958ad
SHA1d2e5f9d2fb84de7be77b2eac9f1c5342d90c41d8
SHA256e44012999db9b982b8035eac151035134d6c46e87ac9beafe172ce9d20f40203
SHA512c98da7c3216140af27b6572edbe5ef689b930242c9e556af75c2f0dd6d0eb39324b030da58fe96f6d6f46136f9fd3e305fcaacc6a5f217efc558b202f28f65d7
-
Filesize
170KB
MD5024912ffc2dfec77654cfc60a58e79e1
SHA16290ac5b3d600b0ae4538b2fec266d6eeb77e019
SHA2562c0d20e63dc8e92781bc8dd9055e37d5055e6f2790276c0dfb36f9a85299b777
SHA512edc4c4ee69c7ff0950a818f0fcf6066cc5e74b143278e4119bcee40d28e8b7508b2a345388215eae1aab817ef10d85b6e56ecd02d1de995a989e1f3f84d667b8