Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
f19f57d4776141262e4d1eedbef0dc60N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f19f57d4776141262e4d1eedbef0dc60N.exe
Resource
win10v2004-20240802-en
General
-
Target
f19f57d4776141262e4d1eedbef0dc60N.exe
-
Size
53KB
-
MD5
f19f57d4776141262e4d1eedbef0dc60
-
SHA1
e928e5c1ef05ad3c657db2fd26a0fc85fa182dbd
-
SHA256
3723657cbd7042dfdf4d10321141082ceb75b9fc45d9e4950daa1dd76b45e754
-
SHA512
e87a5ba971ce12f02daa296d550fb6551d568fd6186e674c4bc2bb06dfe3d3504954a786359e694fd14297a8de898bee501ced94c1f758433b322a3c87de760e
-
SSDEEP
1536:W7ZppApBULcfpHLcfpyDoAQeLeAeLeJ0Pnv:6pWpBwchcwDqnv
Malware Config
Signatures
-
Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp f19f57d4776141262e4d1eedbef0dc60N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f19f57d4776141262e4d1eedbef0dc60N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5daae9e0e40704ec3a00573a47e30b169
SHA11f7aa8f45c34e4a8e1350f11e283f766212bced5
SHA2565ac8fed0ad751b41f065e9de7ff61766c9e352f60473458dd4715bb89527c9b9
SHA512f66fc4d7ab3acffccd7d0742f26f3c71fdcf2b9f3845378a4dfab95d85570d1c136695d7fd7f27dcf87830f1026b60d4e2cd54fb20326ec39f06728239898041
-
Filesize
152KB
MD557ebb33e2f85cf812338a456c6814bd8
SHA19be6f53f2850535c2d1bfc160818492dd1bb3deb
SHA256274853fe90cb94c85159e0643121f4960eb1106589e3c7aec862fb53a299e71a
SHA51288b26cc25d39af0792868fcf97026f2cdbe5f103c3a11cc6d5cc00f752f47bd7e96e5403e014e61627633339c7871dd48e0090b54b9b7eada9fa396f931806df