Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 13:15
Behavioral task
behavioral1
Sample
7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
Resource
win10v2004-20240802-en
General
-
Target
7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
-
Size
39KB
-
MD5
a1895f575b4f43712f948f3ad30858f0
-
SHA1
1bd51368bb18698e33b910af4199dd21501d1023
-
SHA256
7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315
-
SHA512
12f13138203483fb4a99a232ae61a9d78b2ea45beb57b786e4008d26a91f77861173abc90bd78a1d7f10ec74f123fd3d66ae9981dc24a14836bbf483da5afa24
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HxUYyTRPTpXYyTRPTpm:CTW7JJ7TbyxFIyxFm
Malware Config
Signatures
-
Renames multiple (4694) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3712-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000233d9-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/3712-906-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe"C:\Users\Admin\AppData\Local\Temp\7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD55ec282ab790e3d595d5d823a4fac7f5e
SHA1fa91bbc8a72975c18e4a660a574128c2276dfe1d
SHA256787959b453fd2985f9d4b0de0c35a62ddfabfe2fc534766fc9a787cb140f4484
SHA51274ba98a8c08addac46f57f347fb36ac2aba1c36fd50c504f636ed35bd49f4c6c61ae54e2f16a3d429124269253f700e0d7c42e66e6ce21188e00b78c4d30b1e2
-
Filesize
138KB
MD5dc15766135378ba7b14190e9adb98903
SHA17485a75e2e4176e768df168975d5270a6840203c
SHA2562d7b5231b8d018a822aca97dc4df1b61edb49f5adf7c1df3c7ee9445951df543
SHA512748357c8d0b38f254a37349e4ae8d49c52d79aceb26db295331272ddb5c12a187ef38cdd212e954e5b036db28b58440845aacc52c3d51955c40625733f590a11