Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 02:17
Behavioral task
behavioral1
Sample
4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe
Resource
win10v2004-20240802-en
General
-
Target
4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe
-
Size
30KB
-
MD5
ed8471e4f1fa46fe0f4fb7cfa7491c4f
-
SHA1
1707b30122ef537c37b7bb0d62c9987c0495d781
-
SHA256
4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19
-
SHA512
f10ea12687c7e1a18ac8adc79e2e24c5c1d058b7679cbc5fc644e3bf64565b48899c2520b6c3420fd156811ebcd829691570c5b1516d778798b59de71087c9fd
-
SSDEEP
768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OS8:CTW7JJB7LD2I2IbS8
Malware Config
Signatures
-
Renames multiple (5200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1972-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233b3-2.dat upx behavioral2/files/0x00040000000228de-6.dat upx behavioral2/memory/1972-901-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BKANT.TTF.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe"C:\Users\Admin\AppData\Local\Temp\4647898b524a1a222b49b78bb412f11ef8a051a8e512c7bca2a7c35cb2c71c19.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5f93b45498b9733d39dee8973c62f1a6f
SHA13da8fff2c347a4dee919f12484d0de9b015a8aa6
SHA2566162e3bbbab8aa2644ba32c83a38e69dc8e6686ea2569aedc14210ee86726a66
SHA512026bd2683bd8eaec5ae5f7bbde692fa51e8ee570411b0cf236fcacea6712bd330cba08fc103609402e5e259ddc685ed3af0781972f06ae56d048742f3c102b42
-
Filesize
129KB
MD5f3191e3abf4b854b02b2f3bd939d1272
SHA15a5df7dce3aca097ae31598508485370a6675b44
SHA2565c52d5bcfe413c66dff3ca37a5c029288741c47fbb772449dfb5d88971adbdea
SHA512370e206329c15792ae472f4a004bf42852ed1e1363262792d77c511763ff22f72bcf80a2b275af5c14352c22bd6d67d56046ea6a05e9529e21d7d571ccf8e3f5