Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
Resource
win10v2004-20240802-en
General
-
Target
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
-
Size
72KB
-
MD5
ba33a95231a279c05c015444b0727ca0
-
SHA1
51258bd670b5aad477f7978cf7e527b33d48d60c
-
SHA256
e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113
-
SHA512
3475d30da2c1bd6b571e806e2108ddc94a7d7daac7e9e7d829beec36fc1a72e92e1570f41a77d5de6a3ab63e3faab3c6c04b0f168ce416040c96e58b499a540e
-
SSDEEP
1536:W7Z2sspApkZrZ4+fU7lK1lKT8/8yNCNzdwEbdwEE:62ssWpcU7lK1lKgkE
Malware Config
Signatures
-
Renames multiple (4368) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fi.pak.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\DenyEnable.gif.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\7-Zip\7z.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe"C:\Users\Admin\AppData\Local\Temp\e02d3d092ba79953495d5545f9ba4beb8ae918632eaa7853504088895242e113N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD57bec0ac2720a754ea3fe25fb92ef60cf
SHA1f70bc6309ef148061f4cb4404c41cc3861b011f9
SHA2565a7250a475b65e6c8e23ae223f18e98c96b729e62227c689450021547246f766
SHA512d661a564c86d55e7c80e4af9dd5f853d62a007b6dd1da5d9f97e4752eb9f23eed7b40e58c87376e7a61f5aca1b8385582f55f06cc5444e76909332566ef34093
-
Filesize
171KB
MD54f1e98707f67ce1836ef80d11a19524c
SHA1f17df918add52263a3ac581bfe22e39b1666b40a
SHA25677a26d067d8b2d60b50474cc9fd2347ea216f270b254e74110e49eb1c1e9ddbe
SHA51235025aa1a4308df078c43c86e9d5ede9ec2ffa0574af1795da330fc39d7cacc65918af985a39e2210638fd1d1d76fa2e3efd901a940aeab54241b084f356b311