Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
87f89e841c0b69303bb5f5d8465dc670N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
87f89e841c0b69303bb5f5d8465dc670N.exe
Resource
win10v2004-20240802-en
General
-
Target
87f89e841c0b69303bb5f5d8465dc670N.exe
-
Size
102KB
-
MD5
87f89e841c0b69303bb5f5d8465dc670
-
SHA1
b9a796dcef27e2d7803783f7c1658d07c674c7b5
-
SHA256
50504b056c6a8de9609e0f1a9a15b534d428137e86398c7e1bf4d9fd22f79b21
-
SHA512
258f4d495cc38426cfcaeb7d60406d58acacee4f09e385233f226b44f45bacbd7009547d47d1d211134144cba7bd827cde143acd1e26729b1338eda24d53e490
-
SSDEEP
3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9il72c:RqlIyFESWu0SWu86jYl72c
Malware Config
Signatures
-
Renames multiple (4319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoCanary.png.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Crashpad\settings.dat.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 87f89e841c0b69303bb5f5d8465dc670N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87f89e841c0b69303bb5f5d8465dc670N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe"C:\Users\Admin\AppData\Local\Temp\87f89e841c0b69303bb5f5d8465dc670N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4300,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:81⤵PID:1228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD599111a6385a9e7f42e8b0f82b9bc027a
SHA1eae4a644e2fa5270f53758e1c780ee5ac61b2b7d
SHA2569059f3b6c5d3073d36f1dc118807c5e59edbd64a97d420d78fa16c9bcc5b2943
SHA5129dba82c5717e03deaebef9cc767cc49965c75141a0eb60d38af5cec6690b7d85280b9fc1065ae5ad19cfcff0993b9bdc6a3a4db565b6422f45aca308f9f8a62b
-
Filesize
214KB
MD511d59bf233a1461a77a6d8ac31e0f8b0
SHA1a601ca5079800ee3c8066e4d8ec6412b8caa382d
SHA256b8a4bd95f8e35f69379660700df3068e6a7ac011685b7ad01aea82315841ee16
SHA5126619f8abb5be89af5171ec7dfb3dca30e894022578af1e255ff48deb26fec743baacd0a8f268b5d346ba043643ab234fa31ee0e56af8ade45aa6dd9bdb0f6b54