Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 14:02
Behavioral task
behavioral1
Sample
84ecf03159e665094b40610db1a74a10N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
84ecf03159e665094b40610db1a74a10N.exe
Resource
win10v2004-20240802-en
General
-
Target
84ecf03159e665094b40610db1a74a10N.exe
-
Size
25KB
-
MD5
84ecf03159e665094b40610db1a74a10
-
SHA1
2902da62e29029667c16c274340752345900033e
-
SHA256
5f9026c275801c1a19633e009a8940cc6ff667a13ccb2725c357266c90b28437
-
SHA512
9de73755ebcdc2d9fde2b1bf48507420debe689fe6166658a908c6e3f3bf806d6d4959b53022b6d6f8a442e4a10355efbc2082fb95fc687996143a14f4f5a8fe
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9mHJGvBJJGvBM:CTW7JJ7TEHJGvBJJGvBM
Malware Config
Signatures
-
Renames multiple (4677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3416-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023411-2.dat upx behavioral2/files/0x000c0000000220a6-6.dat upx behavioral2/memory/3416-1003-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Java\jre-1.8\bin\java.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp 84ecf03159e665094b40610db1a74a10N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84ecf03159e665094b40610db1a74a10N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD500153a255ae8ede904633102d0415bfb
SHA15d4dc8b4aeb96d6ec15a0e4a5d8009ae4f797266
SHA2563df9992bf470147d19b8c1c4f8ef7f427c01b08e045533f8fcf195daff7e8641
SHA512182eab1538a7fd4f78a7332473ec16d7e203aeb319d7adabbbd75a35ca6abcb2a48a2d79c6edc8581e3fd396de4e3a3f4ae1821671104bf53bfd8b6c573f36ce
-
Filesize
124KB
MD51a7cdf1cafb88e122c9dd9fd38042d71
SHA1331c5c4e30965f31ede13ec41e4a98971dac69ef
SHA2567b35fb9b77dcc1734ebef44983d9e5ad021f3ca3f592a20948fbe89b6b25f261
SHA512f868c66e9ee1963aea7da5ec04ee9cde0b121730363a146bb3d6a5a8c215d11911cef3ac894635bc952525d41cc5fadf6c188ff41c45039a3a003b2735adff71