Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 18:54
Behavioral task
behavioral1
Sample
cce679039743e7de35d770902cf95350N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cce679039743e7de35d770902cf95350N.exe
Resource
win10v2004-20240802-en
General
-
Target
cce679039743e7de35d770902cf95350N.exe
-
Size
65KB
-
MD5
cce679039743e7de35d770902cf95350
-
SHA1
7efb5ae1907fed660017646e04dea850db54e459
-
SHA256
4d635d57482055bb324ea4d3f6b6f5e88ce122a3bbd221ce3b19a9de233ace15
-
SHA512
c3fb2a0fc0551e5eefb8a949607cc4e2cea5932eaa3ba703c8540114c207ff740edef0a3b45617d72dedffe9d96cb56d28d1034db49c64d5f2a8f0cf611ea000
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGE:KQSohsUsUKM
Malware Config
Signatures
-
Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2900-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00080000000233b9-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/2900-853-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\7-Zip\7z.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp cce679039743e7de35d770902cf95350N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp cce679039743e7de35d770902cf95350N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cce679039743e7de35d770902cf95350N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5650966c711fcd6d327d1efe5cb60a8ec
SHA189cf8b1e9f4d49c2aed39708980005b52f01685b
SHA256f787db1c93efe580f1bebdff3bd36f6318d2af0ca73f65bc56a24dd5dcdcde82
SHA512b76b7a84bbff3ecdcbdee00185dcce8a2c16520a4f6026bc803a8d06d2fb809fde796576e559b9d91fecea9311920d4deee5c1c381aa65b1e38a8093d603a0c5
-
Filesize
164KB
MD51224a99d50111c73c1b99347976794ec
SHA190a3c46ea41dd50e8f129a20c8f1886d81bbf038
SHA256f8bf649ca9526282962627559f545b9ad3777e328bb7fa8f8c74c33732ed5e01
SHA51249d418b346d18e38d96c296a0ae17130797c97896e82cf0c6eff1df9b578ae0af5100bc32a6c9e2649c8fc5595d8469d2cce27dc03b1a9aac6d4d1a188585372