Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 20:23
Behavioral task
behavioral1
Sample
b096f159a1610d992aab241f047e0640N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b096f159a1610d992aab241f047e0640N.exe
Resource
win10v2004-20240802-en
General
-
Target
b096f159a1610d992aab241f047e0640N.exe
-
Size
79KB
-
MD5
b096f159a1610d992aab241f047e0640
-
SHA1
00617759eb21bbaae1b16fdff2ebde8abfb8d239
-
SHA256
c59e1f1d9df4e6df6e6e89b885d2a7dbdaa40022dbb57d29f73089da28483606
-
SHA512
f2285580bb195cd5877e15caadf4ef1dac5a4727628d5f079868b9e868d9a47195fc7ad2d8dea9bb15a1103345439bd9ce284f151bcfc99d5a94fba073504c14
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5eYq3+83+BW7quqW:KQSox5y3+83+YquqW
Malware Config
Signatures
-
Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4384-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000234a6-2.dat upx behavioral2/files/0x0008000000023500-6.dat upx behavioral2/memory/4384-864-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp b096f159a1610d992aab241f047e0640N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp b096f159a1610d992aab241f047e0640N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b096f159a1610d992aab241f047e0640N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD59e052ca986cc556fc361fb71825cfeb4
SHA1c6ad40937304910b7ad1dad7ced8e533a6fcb8f4
SHA256efc60c853f5181b2c25523d2fbc1c2f544ba8d80ab2817db09c8064c6da25955
SHA51256ed68292f32303c3da5d7c73d649411f800c85f4655a6bac0a74a114d32ebaad42ef7260e854de46ef9c6b510b0e1f0e6bd13391a48b56b4141030ca8d2a684
-
Filesize
178KB
MD56afd2401c102a32cc7281f75fd576352
SHA176b4cf2dd82e8c60f4c996b8844b5ebe4e99fd21
SHA2560dbb3b2dc1fd1fddaa12e921060e8b40ab20ac27e02f7a02185a23979bf7f61b
SHA51229ec8a0af55d39ae31b7371a64067a476cdb38cb29666a5042af2eb66eb56fd3ad6b02ab0c0573008c0e8dddfb74f991e643a9e4d755477ae1fb50cc40b20d9a