Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 10:56
Behavioral task
behavioral1
Sample
9ea95262a77e9d8728942cb088970de0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9ea95262a77e9d8728942cb088970de0N.exe
Resource
win10v2004-20240802-en
General
-
Target
9ea95262a77e9d8728942cb088970de0N.exe
-
Size
137KB
-
MD5
9ea95262a77e9d8728942cb088970de0
-
SHA1
eef3e8eb3cfdaf01fa5e741e11f4aaf23b9d14a5
-
SHA256
87b5231fe7f51da0d43f42ffd85f64176d582ca5b8ca41d1ad6ed92f88cf70f6
-
SHA512
7266cf4ac2bff082f37c1b37542417108fa96d1beabbb5b52ab4fa020d60595eeee19e0e0981a74776c70faac9c91e8580320cae313a8baa80ca3b0656bf12ee
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTETWn1++PJHJXA/OsIZfzc3/Q8IZTN:fnyiQSo7ZAQSo7ZheS
Malware Config
Signatures
-
Renames multiple (4318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4624-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023453-2.dat upx behavioral2/files/0x00040000000228f4-6.dat upx behavioral2/memory/4624-810-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 9ea95262a77e9d8728942cb088970de0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp 9ea95262a77e9d8728942cb088970de0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ea95262a77e9d8728942cb088970de0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5ed3dbdc495609df69f2b739c1d898821
SHA178856f6dd36acef495bf012dae4ded2024f312be
SHA256f302ae8574b68db4f9e45c071ed396fd0f4f7bc477e759e4d5b754598a0ad676
SHA5129ff0e0a9945023cef28063845228d11b011a0361e5ab01bd19243e63555222f01eb091fe83ec657b4dbf9f2dd2ba299f3e210cd0f36207f883ec587152998a40
-
Filesize
236KB
MD539cf8f25e687cf34b1b18873d3711c57
SHA1a4f3fb8d974e841f2129a5d47e52fa0fdbe5c1f9
SHA25684dafe8f6744ad3eef8c234984eb4f690aeb6712663fbb361505c49a245acb99
SHA5128145670583711b2c9eba514ef9a392e860928a8a9da04df369410d33c4c8a271810ef71cada8271e115c29d6ffa4ae27d25ec2a92b21618ab620ccad2e59d98c