Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 04:47
Behavioral task
behavioral1
Sample
5e832fb9e2826e3f5322c99e1898a640N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5e832fb9e2826e3f5322c99e1898a640N.exe
Resource
win10v2004-20240802-en
General
-
Target
5e832fb9e2826e3f5322c99e1898a640N.exe
-
Size
35KB
-
MD5
5e832fb9e2826e3f5322c99e1898a640
-
SHA1
9da9137f98ff8e8d901744fd4ae10630273d459f
-
SHA256
baa73ba52f59510c7a33b6d9e8c83a11bf8f119094b560e498f544a669a759e1
-
SHA512
2198a02d96a189796a7bacdc47ba33d67e2fe4c0293fa1cf86cd2c454af31f2ba4f8f72011c650a498d5f4df1c03102557e27f9f352ffd8ab69670255eb544a7
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9ffgT+i1xrfgT+i1xtAqJ:CTW7JJ7T5YXYh
Malware Config
Signatures
-
Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1952-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023404-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/1952-902-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\AppXManifest.xml.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp 5e832fb9e2826e3f5322c99e1898a640N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e832fb9e2826e3f5322c99e1898a640N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5a232f741053ab51e3c88bff1e2e898d5
SHA182a4852ffb3795c325261434c1d03316f6dd3b18
SHA256ddd11c1ed206fb1fcbcd232f790c0432e2694ee8dfc8e85a014adf1d4a58e386
SHA512fcb5efec0e278c3c08492ed3a721f0a62dc30ccc93b625a5d6f7341d003da76630a9923c9178d6d37536d14b60f826bf43790a56fcd0522e45e2b406deb7fee5
-
Filesize
134KB
MD59f010b382bac738e176723d08a046049
SHA197b04dc27f671d75e43b6cdb30aed14bc71f08ed
SHA256e650de2224c3e273c8cd052a28f68d2c9c02088519e495c94a921df20fc2a49f
SHA512fa96882dc726760d1bd94f9028b053f9c1ef1a7fc53e2e0086ff9a2d21661079a7a3774de32e044d465c0e685a7cf3dffdb72020434b4d1e16f18a86693552a9