Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 17:59
Behavioral task
behavioral1
Sample
8fc3ca9959579db14810ac7e86363c80N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8fc3ca9959579db14810ac7e86363c80N.exe
Resource
win10v2004-20240802-en
General
-
Target
8fc3ca9959579db14810ac7e86363c80N.exe
-
Size
57KB
-
MD5
8fc3ca9959579db14810ac7e86363c80
-
SHA1
51280d6796f9c4d3f9bc5d1e863cec5711fbee4a
-
SHA256
d30c6c04e31930e3c66c06a09ebed7c1a17d1938131a5a115bd55f421ab13559
-
SHA512
57b0d489d7cbbfd4b05cf69eff0109dae0debaa5a8e773b4326ad27d0779373cf1e38ca990af6e0aceb109c998b55f271c81beeb8355841c5faf4dc327516712
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBaMYN353e353i:V7Zf/FAxTWoJJZENTBTY5
Malware Config
Signatures
-
Renames multiple (4361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4416-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002362a-2.dat upx behavioral2/files/0x000600000001690a-6.dat upx behavioral2/memory/4416-856-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp 8fc3ca9959579db14810ac7e86363c80N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8fc3ca9959579db14810ac7e86363c80N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc3ca9959579db14810ac7e86363c80N.exe"C:\Users\Admin\AppData\Local\Temp\8fc3ca9959579db14810ac7e86363c80N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4416
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:81⤵PID:3360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD52c3c40fa4d47e5fd6321c0de8b397c97
SHA113b1c6cc394328be452998ef2d65929fdcac9043
SHA2568ebc032e9557a5e6de8d78141ccbd6b5b08676f556739b4ecd58c1cec75deb03
SHA5123a7f74b29b0d7ce66dbad7232e597924ac5386f3cce1bc541c073be2179dfc9dca886c989d1a9d617d686575462f8decf2b33777a6340e7ddda099f336bffb18
-
Filesize
170KB
MD51b1c1eb64dd901c2597cd3c2bc9a447e
SHA1f780cb88058e15c6ea0dad84225e739e2f0a95d6
SHA256e9d564d561ec1ea289330ef890263f919e797716580b372d1041674aa2af3cbf
SHA512164747a273818e90a3e21b2475934c628314ef569fa228f6009307948759f800e0ffe80fe0a6fbb0381c0eade2f5cbc88c600158c6f934b428a6104453bec97f