Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 06:57
Behavioral task
behavioral1
Sample
a765590f8485e653819d8e0832b1fc90N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a765590f8485e653819d8e0832b1fc90N.exe
Resource
win10v2004-20240802-en
General
-
Target
a765590f8485e653819d8e0832b1fc90N.exe
-
Size
54KB
-
MD5
a765590f8485e653819d8e0832b1fc90
-
SHA1
2cfad5d0fb72e190b59752351daca2670a596b97
-
SHA256
d32848fc09fb814245e327e4d417904ca4b5ae7b666e3ff05aaf2fd384de9d54
-
SHA512
61a25cf71bac2fcf91410c540e795fae78b6e962efa3e44c2fe96dc36208dbcee3495b9652900345d4ba27af0443bcac0437ef62d532605419838b30b664b3bb
-
SSDEEP
768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQ7ZVnEbisFhiXFhari:CTW7JJZENTNyavf73tQqarjry
Malware Config
Signatures
-
Renames multiple (4528) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2444-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0009000000023474-2.dat upx behavioral2/files/0x0004000000022922-6.dat upx behavioral2/memory/2444-802-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\msado60.tlb.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp a765590f8485e653819d8e0832b1fc90N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp a765590f8485e653819d8e0832b1fc90N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a765590f8485e653819d8e0832b1fc90N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD51c390cf7b875950a9bb605030d190fcb
SHA17661c7dbbc3df41c90ddb5588846968dbf6ec362
SHA256ff3f9c8d86f9fd655ca1bfc7328358a1cca282f5f5485bd07c1d6faf99a18f25
SHA5122d8c9f92142e8f8ea34b01596b0ab7af32839f2e2be3bbbeb61b8d500c9ffcf7c7062069606d3ff20a881102038afee6436361c684c9e693dc4af05fc3e07ed1
-
Filesize
153KB
MD5ec3db00542d3a439185ad9967ab956e1
SHA1c3de409be6a8d9fbdc3d6abc027ea4fc975b69f1
SHA256116effe604896b3cd5f15bcc578a3fc7bd8e38d0fb4136754deee07fb01accc8
SHA512c10ae89c6bb69f765e39887cc0760600b47aee925c28a5f341d9663dadf1bbb32600fe2e6c35cf339887a97a68958bcb5bf4dbb12d4f058b7d874572f97e1edb