Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 18:31
Behavioral task
behavioral1
Sample
8e51904330eae5bcfa13b6742159f8a0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e51904330eae5bcfa13b6742159f8a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
8e51904330eae5bcfa13b6742159f8a0N.exe
-
Size
36KB
-
MD5
8e51904330eae5bcfa13b6742159f8a0
-
SHA1
516499c2849e8712552720a9745a25d049d47fdc
-
SHA256
c6881e3391d157a1c6ff631617d88394092fb098b647a624c1a86309f7fe8c31
-
SHA512
1a7630938d95caa29c684e9df01ccaaf4bf30b8154044fefaf90dd05d66233eb8684ff2381dae2512430d04203f1d65443e42418038a0ab051c43fbf98bd5a15
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9cGsGWoyoh:CTW7JJ7TyGsGDXh
Malware Config
Signatures
-
Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3748-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233e7-2.dat upx behavioral2/files/0x000400000002291b-6.dat upx behavioral2/memory/3748-798-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\7-Zip\7z.exe.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_wer.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 8e51904330eae5bcfa13b6742159f8a0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e51904330eae5bcfa13b6742159f8a0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5c719ccaebb57e2b2d1e140be3e761b51
SHA11d10caa236d82a04d1c5c66abf9937c16587f643
SHA2569af81bf03c1153ea321ceed0d7b724cc6ce7a5bdaa58b0bbf20fb391d872ffbd
SHA512671dff537951a9070dea2e4e7021d8da3ea0b513a3e77bd76a56d0ba857db5fdb368dbad15c7002a3ad0e5d5add078d8c4ea08242533d2e05297a751588bf3da
-
Filesize
135KB
MD57e8423824ef11d969aa65b6f6f55be8a
SHA1ea825b7aec3fc501d0f64b3e1530a4d9acae9727
SHA256e9c9f95943b19fa1fb9558aed886ffc708e1f8334924ac544f95519f28c03d9f
SHA5128884a8039aa5e9c5046520b94b0a7e8584c570aab9e3b5947aa6f466e22308b3d83c8c10c7a0346d0d9306086117a7d08134ea9b6dba6de4dc1f771cf04f8747