Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 18:15
Behavioral task
behavioral1
Sample
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
Resource
win10v2004-20240802-en
General
-
Target
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
-
Size
38KB
-
MD5
6a7710bfd0b7ba252b7b10ea7387ce96
-
SHA1
55b66324ee189d7d094b7fdd92d9f7c951c4a19b
-
SHA256
028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13
-
SHA512
16de6407853ee3d39b6a40c7193171c74ebd43967a94c2742403dc4d45d7f4c2b4ce37107699454f5c34fe99e2815ff9b50b75897faf1ac0100defddd16ff868
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJPbUSzsOVClbdz3sJ/F8gzbdz3sJ/F8gm:kBT37CPKKdJJTUNO/
Malware Config
Signatures
-
Renames multiple (5198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3224-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233cf-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/3224-915-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe"C:\Users\Admin\AppData\Local\Temp\028b095f2f1324663a38991a0e75947027c1c54f8aed5950a864684b84873f13.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD55ec12655bdb1d6371971adbb3301a5a1
SHA12f0ff1806065735bc0a78f71d152f9a7fc7d95af
SHA2567f9211475a86c3d5c78b40932ba0fbe820c91c888de778a6e0091980102ff947
SHA51242b211844a9533c16c831048f7eb210b885b5c81e1f941793678c3d1d7abb2979c787954a07fe2f7d350974b2e845d71cbf77d8ad8c6ac0f5583f00e5860b1d4
-
Filesize
137KB
MD5f93b1f8094d820449108df69fc9e2975
SHA191180a1cc650035bd44decc4efc60310cbe08850
SHA256985ba6db6fa8129e8201df5e31cd0ef58ccb99fd28ece18b243596b856dcbac3
SHA512c4f9bf56043ae00bec919eaef8548c8512467f37782a07bc437fe9f299abe8d62c2aa75c23f54cf5b4f24fde3fab9329b19e23167decca8b32891d8eecfe3e4e