Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 20:19
Behavioral task
behavioral1
Sample
bb8c4f50e02ee18acc4f8c9352bd7490N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bb8c4f50e02ee18acc4f8c9352bd7490N.exe
Resource
win10v2004-20240802-en
General
-
Target
bb8c4f50e02ee18acc4f8c9352bd7490N.exe
-
Size
70KB
-
MD5
bb8c4f50e02ee18acc4f8c9352bd7490
-
SHA1
5bc46faff40da31563e1da4003044cee7f5b5ffd
-
SHA256
0bbb4752ff2e1f42bc65be3f0b3acc75c280aa39aaa625747b7f18600e66cb7e
-
SHA512
545a04851ea591dbbad66909548d68e44114599a3529f94c4e6f90d3e269303eea97c0b4f91d852a3040925b80ca24d8034c46d37a63023d0ba033dbd8dca247
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tirZcZja:V7Zf/FAxTWoJJ7TTQoQrZcZja
Malware Config
Signatures
-
Renames multiple (4355) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3652-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023451-2.dat upx behavioral2/files/0x0014000000022913-6.dat upx behavioral2/memory/3652-804-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\7-Zip\7z.exe.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jre-1.8\lib\currency.data.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp bb8c4f50e02ee18acc4f8c9352bd7490N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb8c4f50e02ee18acc4f8c9352bd7490N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD567a4e53c7f6a4da48c21813fb6305cb4
SHA1b69263edf01f96b0554ee0fbae84f8df44734d71
SHA2567e668a7d8df5ea9df5ff97b25c210ad94cce8a5697720f605d07e2c8f845f3b9
SHA512486b338d95ef31c76689bf634326e6a434bd97329ae8a12a85c0447605a7bdd789082e165a2c73a08ce31817c8fb1d42823aeca5f511d6830cfb0ac3c5713404
-
Filesize
169KB
MD5078280584c3114dbd64b885e89447879
SHA1fca67376ccd04c890bcb746005f9c286ed500507
SHA256484e79553cf004f26567ee8bf9a70a04a07a53c41eb176113643dc3262100026
SHA512754555c497629d25faf800a9fd7ea6c8a876d61c163eade5dd97e6f26e2ee0948df8b3243c1338a28c0f656ddc7ef3f9588065a313e8d2159ad0e12f4626de3e