Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 18:22
Behavioral task
behavioral1
Sample
16dff8bc7961e4b6a64cec93fcb80540N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
16dff8bc7961e4b6a64cec93fcb80540N.exe
Resource
win10v2004-20240802-en
General
-
Target
16dff8bc7961e4b6a64cec93fcb80540N.exe
-
Size
33KB
-
MD5
16dff8bc7961e4b6a64cec93fcb80540
-
SHA1
87a5c36bf285ed1bf30a3533256572bc56239e06
-
SHA256
3f592f5fb10f63081efcb866540f9f1e9d5db254f77f7b8c03fecf0f36edafaf
-
SHA512
5247296bb9b08d3fd2fac17dd57a4eb786a74152b6ffc6766a729900af089149c56c30b334c38b464c52eaa38aae7ca9c3ed38c117d472c3af0ad2063d472146
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJPbUSzsOVCjT+:kBT37CPKKdJJTUNOQT+
Malware Config
Signatures
-
Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2020-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233d1-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/2020-855-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 16dff8bc7961e4b6a64cec93fcb80540N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16dff8bc7961e4b6a64cec93fcb80540N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5f2767e91f97cce54ff883c85f5b1931e
SHA116372231fdb1a75673ba93266e70d8ae06cbe7d1
SHA256872b04d94d65b27f526efb66b59b6fb6c6c96d34feb39525798877b3d38d052a
SHA512a347711aeb25bd813fbfb8aee326ce07cabefe55a30f1bf43fd95e416c1efd4b241e8a427ae49c09f1db3375499e773857490ed6cc0f3128bf801aedc139dedf
-
Filesize
132KB
MD5e170b1405c334944b40d4268c5fd5f65
SHA12007ad3bc293a0ed58b797a67046ab4f6ebe1b6d
SHA25687a9f768cdf8d8a329cdaa0f7ced83d49853fddd87a13fa8350fa45c85eda5bd
SHA512fe7d4f402aea7e2982b47f9aacb079e385619bf9120af8a294107a234f74f1707389c5823d106adcfebeafd45609128a2477288c9c89906f0a7dcbe370dd2695