Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 04:01
Static task
static1
Behavioral task
behavioral1
Sample
13864096e495143282a2f9d44e708d00N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
13864096e495143282a2f9d44e708d00N.exe
Resource
win10v2004-20240802-en
General
-
Target
13864096e495143282a2f9d44e708d00N.exe
-
Size
108KB
-
MD5
13864096e495143282a2f9d44e708d00
-
SHA1
b61f0710c90fa810b9ff60e1b8462e6be2641303
-
SHA256
a0d59f4029184571c794be645cb96dfc940c3a1cddc4bd83f6e9ca7feb1450fc
-
SHA512
14397143ba6de5dc8c58fe1a23220433c964ddd69dd371b0c9d385e707939275814c175d1ffb302784ca2659eb2e0a721795c1bad9248f72cc29627dcd80dc7c
-
SSDEEP
3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBT:PqFF2Ie+efsim2k
Malware Config
Signatures
-
Renames multiple (4303) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp 13864096e495143282a2f9d44e708d00N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp 13864096e495143282a2f9d44e708d00N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13864096e495143282a2f9d44e708d00N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD50837cf2916e411ab0e48dabb5a85b2b7
SHA115220295d502678a2e9916b7e6414fba04e08999
SHA2560929918c96417e91b447bfc75a466ea7e582ccf69bda168127070ae2548d20f7
SHA51225a8e05a9a104e4cfb0e1afa5a759601a95d4155c1d9885cf292f54c2f38de4eccf8e9b943e753c8bd62ebc14fc7af5eff586f96ceb18ab517c02515463d3d81
-
Filesize
207KB
MD5dab8ef6bf8d3b87665f4b3c814a59f61
SHA10b68560d79032ee67db7ec65313e5543e9f087e6
SHA256aa7db90eada156e13f172ce2d2c42fb7aab235c7b73ea34682659b92c4bf16e0
SHA5126d7c48354e4de67196f0c017bb3316e1e0056c593ddfa50fbcd45f9001c8ec9ccb0f7141960c6a95ccf63760701c871e2f99af27fbf40808c304f3837445dc52