Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
ec65f51dd55ccea3352eb2bf128c3b80N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ec65f51dd55ccea3352eb2bf128c3b80N.exe
Resource
win10v2004-20240802-en
General
-
Target
ec65f51dd55ccea3352eb2bf128c3b80N.exe
-
Size
80KB
-
MD5
ec65f51dd55ccea3352eb2bf128c3b80
-
SHA1
556cd90774f5dcf593978901634169daf2878ec8
-
SHA256
48c61a95953379cee69a02a9dc388a9db20a593ab633d35ff863950d937afa45
-
SHA512
7c7aa58a702d2a7c048584bd93f7eb35f821f65d86f21f5d9ad77c6e13d7622aee9e76b94430ec34211634e36229f8cd30ca3c14382502c1d2aaa3e066f1ca6c
-
SSDEEP
1536:/7ZQpApze+eJfFpsJOfFpsJeFrxFrd466:9QWpze+eJfFpsJOfFpsJ0rDrN6
Malware Config
Signatures
-
Renames multiple (4636) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\mojo_core.dll.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp ec65f51dd55ccea3352eb2bf128c3b80N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec65f51dd55ccea3352eb2bf128c3b80N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5aed7d9f8dadae7f4a64da58b60b27b3f
SHA156cb37c14296a7d935c4b87c6d44848075cef98f
SHA256196d5e92fbed00b8b73bcf7ef7a80c8e1542eb0dcb6e4efbe0d79dbaa2b2e7d6
SHA5126d2ee24536ba4ad9bf5d51f6c1e747223c75e285c39ff27f29ec355536cea4ea69d4360d62ab1f9cdda780a173e032f937815d32c8f06882644a165cf60aa7b5
-
Filesize
179KB
MD56dc6f5d404337487ef96f38a89f3aa3e
SHA17113e37a45dfbe6307489b156564f57be36d1387
SHA256b953baa02160022459e8256e9952663c60229acf86d21220874a7a6422aeda37
SHA512597523cf48240040f2c1f9535b19a1c310550776e03500a7a46cec4e9812d1f7cb42ed1b98f8769e4a8fefa90a723e06e5129165d951b5006394029bb663cf3e