Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 02:48
Behavioral task
behavioral1
Sample
e1e5b9498ccd970d7350bf2a19050600N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1e5b9498ccd970d7350bf2a19050600N.exe
Resource
win10v2004-20240802-en
General
-
Target
e1e5b9498ccd970d7350bf2a19050600N.exe
-
Size
29KB
-
MD5
e1e5b9498ccd970d7350bf2a19050600
-
SHA1
b277b801f86c21942acecc8b02f640e6ee9d2af8
-
SHA256
5ee6d2f285765f8c82c3312129f0840cc8d8d9ba9fdddab4361d23ee69f82329
-
SHA512
b6d19bf6d2e3d694922381c5122c97003eee584f7c300be461e0d3023a02c165329a31a0c6679db735a02512a69b6d91f69a05c011095db3a5d6ccb36ef00e6b
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9ZJVuE:kBT37CPKKdJJ1EXBwzEXBwdcMcI9ZJR
Malware Config
Signatures
-
Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3172-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233db-2.dat upx behavioral2/files/0x0014000000022936-6.dat upx behavioral2/memory/3172-933-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp e1e5b9498ccd970d7350bf2a19050600N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1e5b9498ccd970d7350bf2a19050600N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD538b43ced98dea5f5f2ad7d0181f1a99e
SHA197210375d827d2c6d9b9a757fb982268fedaf53c
SHA25622fe0736af6795e72ec47b84a39de87f36e1a5b35925a9ab9d47ddde73d45f89
SHA512e60e503e07a670b7e4eb80f4cddafc56521616c9bf34020f7504e57d1055c65cfd0b771af0ff7143176cf599b457a7668f937d21af013d7de631aba5cb4542c0
-
Filesize
128KB
MD5977a1525a4e96cb38fe5deb4837cd80b
SHA1b71d584ffb44b2d98a09c4b54035bea72c59a21b
SHA256e325f2a4f76b2839990011275c51500789e824ecef35a141f99f46d34c5d86b8
SHA5128c3d44aea68bcd4259f37962b6d1e3298d77b90df74d3dd3fd31e537be492fc533abebfa79c8ea2da420ab7834fa0146ff12354700c662f6d8d4f9c727d8296b