Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 10:00
Behavioral task
behavioral1
Sample
ef33cca6c657b0841236c1cf3157c8f0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ef33cca6c657b0841236c1cf3157c8f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
ef33cca6c657b0841236c1cf3157c8f0N.exe
-
Size
54KB
-
MD5
ef33cca6c657b0841236c1cf3157c8f0
-
SHA1
17ef73bf2e2df47a7dd6fa990e8de74565744a00
-
SHA256
321a3d99805bad39358f205b6a6384a67ee775be5a4d4c6b601faea89a83a86e
-
SHA512
cde97df4550e0515cfa2a30ac541a1ac4baeddf2680f168fa7407e3b8bee00983153eae684e58e893a2713e5e0356f0daa5d0bc895c8a46af836ce95b73d255d
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9bJSsJSCQZbQZw:V7Zf/FAxTWoJJ7TFJSsJSBcw
Malware Config
Signatures
-
Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2616-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023490-2.dat upx behavioral2/files/0x0004000000022933-6.dat upx behavioral2/memory/2616-928-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp ef33cca6c657b0841236c1cf3157c8f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef33cca6c657b0841236c1cf3157c8f0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5d9fca995c9b724f0fbd41422b84ffacf
SHA10ef15f814b620328092e9b5c35ff7f614e49e78b
SHA2560bcbd52600938b75bed570a21f469f2e0fab281bd56fab9d0987fcced3aa9617
SHA512d4601899fb7249cf2341dea8fa1f8dc0ea4e28d43e622073f6cc16299693c6a9a3922a6a1899f3f83a6a928009dd8255037780180c7f53dd9aba248dbabd8a03
-
Filesize
153KB
MD59ec6f804837768591be7ca66c577f7c2
SHA14a56a2249d9ab24b05410c26e46a5323e62bfe63
SHA25610268c058415e57b960cf4bb6f81529651618965cc76b0511330c99e5c387533
SHA512cdcb700740d1e4f1bec3658e2ac160fef51e1871800042a05cab511b16a6955a750c857658071570486636fac5e0d677f741d2b0142416dbae6c25f3f2c2e64e