Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 13:25
Behavioral task
behavioral1
Sample
91af6d4c720287ff4689db2d1a000310N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
91af6d4c720287ff4689db2d1a000310N.exe
Resource
win10v2004-20240802-en
General
-
Target
91af6d4c720287ff4689db2d1a000310N.exe
-
Size
31KB
-
MD5
91af6d4c720287ff4689db2d1a000310
-
SHA1
911a1ceee67326bb88f25442444f5dbdb3a55a00
-
SHA256
5e6d62e28b5f39944528ef40d708a06ec10924c24fb2714dbb67bb189f9c5651
-
SHA512
8698192f9b6b33950939081d0729440af0ec4faebf56930a3a6ad630e57c9df263d537bfdfb3dfb0c6c5d7ab2d7c53c6dbf7731af190232229ca94989562dbaf
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9B0Q0/C:kBT37CPKKdJJ1EXBwzEXBwdcMcI95rv
Malware Config
Signatures
-
Renames multiple (4657) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3612-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000900000002348b-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/3612-860-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\ExitUnregister.odt.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp 91af6d4c720287ff4689db2d1a000310N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp 91af6d4c720287ff4689db2d1a000310N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91af6d4c720287ff4689db2d1a000310N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD57b3d5b6003d44b044847c42d71ee3726
SHA10e32b86b6389279f1d141815ce3c263227a99b75
SHA25622e551a873b0357eb0b0fd169485c80a2d4f32bd5c45705104b9ecb6dd3b585e
SHA51297be0ff01211d98279c08576625f4a0fe4fb58bd91ab3d9687dd6d29166ad9b98edeb1c003a81703dfbfec8b6f9ea196efbdc11d2c9a093c88984f30cda20740
-
Filesize
130KB
MD5daf2121846911abe2ed91cc07c71762b
SHA152d416c4ad8f07228de8ee74baf5193ecaf5d724
SHA25670b6f1c5c7cf73cbe3180a078817379c7df10e57e8bcc90fa6ffc300a93328c3
SHA51270f98ebf11c59cf2db5baee0e5f5c1c83596a25f866e7c716f9f2e48b8a70475ffe5fa303af28f195de4dcfa1f1c51bf870a801cad023f1117184398c9e71110