Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
-
Size
61KB
-
MD5
8a6482ace82910ef617751edfa48fdd6
-
SHA1
fac0cfe15821914a9dd16ff9b50a633431ae1139
-
SHA256
08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53
-
SHA512
bfe8bb01c013a518db39abbdb95ad9f62c042791356943741a6b6986e409e385808643fde2b0f0319a95ee0bc230e666a8ef9716fd222097701cb00999e20f1b
-
SSDEEP
768:W7BlphA7dASbSjJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiBhRKu:W7ZhA7dABJJ7TTQoQNKu
Score
9/10
Malware Config
Signatures
-
Renames multiple (5191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe"C:\Users\Admin\AppData\Local\Temp\08a683769d3e3d1e31a68534a5f855a0dd394c391ee7b278ab69c05c6caddf53.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5bc1f21cbd2e401dcaa80d73de5428c63
SHA1e759aa48e1463f40448a499a044b1c777f6d0cc3
SHA256c38f640e45fd246f5f89f678a76f71ab14571df82a3423ea31bfc77f953738b5
SHA51210b280f2ae30a54fab931a6d2d2d11d53a03afce493fe9c474da7442f748f3070675b8a568521179aef9b8714b1bcaf9fe803188816f37eb1aebdf16681bd1da
-
Filesize
160KB
MD574e32236a52ffbed3a068a54c59f295f
SHA1aff40218fd8af60a77146bc8598dc228ab9bd6a1
SHA2560065be9dcc82eb7a77c3e5e3438a0f847ad9e49058f19f32e671ac55c72fd0f4
SHA51203fade96d5743c704f79ce63cedb39530626b13573377ccc7cdaf908d037a80a42700a825a4a2825271a8467585793c1102eb3727812461e46dba4f3129a49a0