Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
97f56ac09f9b371e994ba93bb90bf020N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
97f56ac09f9b371e994ba93bb90bf020N.exe
Resource
win10v2004-20240802-en
General
-
Target
97f56ac09f9b371e994ba93bb90bf020N.exe
-
Size
48KB
-
MD5
97f56ac09f9b371e994ba93bb90bf020
-
SHA1
6cc8b5bad89b0ea91a98a190c03db7e6242119cc
-
SHA256
1aea7e13980730f57ae3ae556e69008f43683625aabe3625f6becf8aa5dc76c8
-
SHA512
1e1e72057cc9fa21b99b8b996a334ee843f0cddaa148385cd241f9704930324cf8e5e31b021ff3c240b46f19052e4b03e9400bf82b597f5d0071edf753536545
-
SSDEEP
768:W7BlpppARFbhHFoqAJwBqAJw1VyjVyhbabgNT:W7ZppApyVyjVyrNT
Malware Config
Signatures
-
Renames multiple (4526) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Common Files\System\ado\msado60.tlb.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\AppXManifest.xml.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\7-Zip\descript.ion.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp 97f56ac09f9b371e994ba93bb90bf020N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97f56ac09f9b371e994ba93bb90bf020N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97f56ac09f9b371e994ba93bb90bf020N.exe"C:\Users\Admin\AppData\Local\Temp\97f56ac09f9b371e994ba93bb90bf020N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4316
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:81⤵PID:1188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD558f452c4fb038fbd7ade0fc1fcf2543a
SHA1cc11dbd5b80f7ee6421f2e1bc5a22e97cc06d0a6
SHA25669b4ac576507746e6b57f2fa2c22ce7fa8e0b2df6d307fafcc20712516aeb068
SHA512b86739cc1299c733bd5fff99b6aff5816df8d3471864a1a0d68aec27d67a25b4621ce40392bfdccdd1443aad4727c2dec60b4789adc84ad6dd810fa0b3098f13
-
Filesize
161KB
MD545663cfa9e7c0fac9ce1d99205f602f2
SHA17e8ad2ae102aefec555de3552290e814fed1c3bc
SHA256c7ab8c9701955c8746e2f5a19fa0259659e32f662f0ff7095717e8f01d4f106d
SHA51244402363e2edb72fe3c36a24d8d8d6a504f018a026eff854925b035b0909d75aed436415d02cd4fccfb9031b90484d532f26b0b2d1a829c7e46afa2523d3f905