Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 06:17
Behavioral task
behavioral1
Sample
3931ab173fd83144e591fe8767baa710N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3931ab173fd83144e591fe8767baa710N.exe
Resource
win10v2004-20240802-en
General
-
Target
3931ab173fd83144e591fe8767baa710N.exe
-
Size
88KB
-
MD5
3931ab173fd83144e591fe8767baa710
-
SHA1
6ea23fe9aa7eaf6cdca175d740001f7ae5b9d60e
-
SHA256
45a007b67413484340ed8624b66b71e33480fef4f411dd83b137898923f3892e
-
SHA512
8d98a4fa0c89379f3d06a6268ae1276c61c8d05bc17945200e2a09c443dfb55aff71d23324194811599576188bc90f64179d89716e01fdc767bbf14deda68aca
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTNyoKIKMTTW7JJZENTNyoKIKM4:fny1tE5KIK7tE5KIKv
Malware Config
Signatures
-
Renames multiple (4244) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2648-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023444-2.dat upx behavioral2/files/0x0014000000022912-6.dat upx behavioral2/memory/2648-770-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 3931ab173fd83144e591fe8767baa710N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3931ab173fd83144e591fe8767baa710N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5f4b125633c76cb936a820d13baf48285
SHA134aabb7680ca224a49254f7c3b38fb9eac2f0bad
SHA256c9b514fc7fc3c894eff6b2ba29854429f4f6491cbd2db7586a0a82a9c01fa7b7
SHA5120e7ebf77cd410e3d4617f6c0de6de18f13ef2e6f75e9ed60fafa075badbd806acc5c5468e2f6fe0f3a4d17eedb47997d74a30c1afae13954b0cc311b6f91fd98
-
Filesize
188KB
MD5a40524f86255b77cd9d4774674357f98
SHA131bb00723dc84d33146d80007afc235dac52d50b
SHA2565c04d579dfcf3bf4435cdcfb1d0a27d4284dbaebcd6823fecda4f77e703c5918
SHA512ae191175fefe046e1a69629e9259533b1858686aab2600dfbbb6101c55281fab34a470da433372146f74b1dba8631bb025e037e0670e16825beec12dd09db173