Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
cb20a9437a9b68af88de6d7b193cf8f0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cb20a9437a9b68af88de6d7b193cf8f0N.exe
Resource
win10v2004-20240910-en
General
-
Target
cb20a9437a9b68af88de6d7b193cf8f0N.exe
-
Size
55KB
-
MD5
cb20a9437a9b68af88de6d7b193cf8f0
-
SHA1
2a99bf191cea02e57aa88e4fe73732cce8702bac
-
SHA256
daa168d4bf18b57821fd1e511fb9b38e3ed40865c768136f0ea2e08dc32aba3b
-
SHA512
bd383dacbb43c4a4e880ffd0948b280c91d6d90561d3bfa85f7c8e8e2ef1b79719bad10a6f68844e146be0779c1afbda016b1e5f6f2beb16e1a5b9a1c0ce1211
-
SSDEEP
1536:W7ZppApBULcfpHLcfpyDDnTxASYnTxASshPWC1:6pWpBwchcwDDnTxASYnTxASeT
Malware Config
Signatures
-
Renames multiple (4618) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp cb20a9437a9b68af88de6d7b193cf8f0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb20a9437a9b68af88de6d7b193cf8f0N.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD56aa873bc8e1c1cc5cc4c03c2e22e064b
SHA10ac0a20734ecd78a869d9a5480ae5dd07933f701
SHA256ddf796e02d5231340c35114f5efdfc11204c75f19ec7507e340e51d459faa93c
SHA512bf85e195be79562836840825e8479b399c21fdff834bcb7961a81ff4fb3b4cd1585be59a49fe141d819c341288139d96ffe13e47e309f1fb7afa76fe75eb2909
-
Filesize
154KB
MD50431daca1a0d36eb226fcf1e900f795c
SHA1995a5acad2f9b5d3383a2843976705eb193aa5a4
SHA25637f191f6f036527dd7507260999adb7142d1320fdfb34d4cf984a746461b7308
SHA51253f97378f2c4c5109a172f508121928a3db8f46bcfcc7e118a33418c1f406d43877eea245747aa3b864b32785417d10bfb92caf59cd7809599b1d6dbbf8fba22