Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 06:01
Behavioral task
behavioral1
Sample
863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
Resource
win10v2004-20240802-en
General
-
Target
863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
-
Size
46KB
-
MD5
0650dd4f85e24d53173b1b639601e8c0
-
SHA1
7f28fe752ac71e9875a4fad62e4a3cdbf644ec9f
-
SHA256
863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cce
-
SHA512
9b3b8cff32b4b708c04810acef6a5adaa4e02d53e93717362c4cf5a788e35df749c6ea8276ed3d6dc5cd72176d7754ae711c2a03fe284ca545aaee5a528cb05b
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiQ/Gum/GutX1vqX1v3:CTW7JJ7TTQoQE
Malware Config
Signatures
-
Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4416-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000900000002346f-2.dat upx behavioral2/files/0x0004000000022933-6.dat upx behavioral2/memory/4416-987-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe"C:\Users\Admin\AppData\Local\Temp\863a5e28254398927879c15762319350797f9f8241dcd590305eafdbd7b79cceN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5f43fe72d82023fc858b0662ea6c95de0
SHA13dec3ca6158b536e7347b0fc01cb69f703c6e903
SHA256d6651ff49425db0f6beb9991cc1397a071281e35cfeaebdab59c5b9c4e965566
SHA51297a94290559843344b7d936a5d74c473da82d806fbb6f0fbc7508362b5b0d754df0cbc308db1de9fb49963a5929745b47b87dee671276ea9f2e27f51af3965ed
-
Filesize
145KB
MD592d6e53a8e604ccf8c2b056034141793
SHA1693dac34d5f695e98b622c41c973c3732727c61f
SHA2562df6f13d16d5d594a6172745ea81a31e33a0b5416fa11cc174b74af8dab926f2
SHA5120996db21de514f8667c2c967be04ebb876ff00fb5f0f196fdcfcf2791c68c36cfd9b0149818532db7d076dc7fd3b673de0fdd4dd04306e5b6b4dbd800f3c6aa2