Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 03:53
Behavioral task
behavioral1
Sample
fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe
Resource
win10v2004-20240802-en
General
-
Target
fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe
-
Size
76KB
-
MD5
a217184e32bc2be542231eaf972c5976
-
SHA1
527edbda97bd0b92227238a99c2f7033f483032e
-
SHA256
fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634
-
SHA512
e9cd4ce0cf923e96bd2da0214bfa71bd82e852894674db447c19a4e88aa4e49fdb450da30cbafeef9bcfd27d896d52e8dc15662f0e0d6c25245a283def5d3253
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDxfIyKoIWbsHfySkT5GeCyi348oWGh:KQSodYeHNmkDxfIyKoIWbsHfySkT5Geb
Malware Config
Signatures
-
Renames multiple (5046) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00090000000234b2-2.dat upx behavioral2/files/0x0004000000022933-6.dat upx behavioral2/memory/2980-909-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe"C:\Users\Admin\AppData\Local\Temp\fa07f8a8d6fca285a328fdfe09c2cd09908d0333e5365c8143dfd5ee5c776634.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5655fbbee9e8c947f922c1baa7695049c
SHA1c815ed4b1abb3c6afa737a405a0ff14d57148f33
SHA256e492049d22adf3ad5fa3c89d5c4ad6dfe1a3126b41698ac96ee2b9c30b77fd4c
SHA512970be18b53bcb233b7c19b2605975a1457423da4035631063e18be9664740bfae6506836e4d26b99da4527f5c4d80a375d05aacbf42568db8804089484f83adc
-
Filesize
175KB
MD540496e79cc1e91162dde857a70667405
SHA1fc6caf5a104bcba4dba6493aba975e38329205b8
SHA256126b89864d18fc5164e61e7ea8e0d988733100fe3a9240ffc775282ab72f3c83
SHA5122fc908451f2606ef810bea3352c8c4007488962a5f46b9bb2256e31b3382a326e4bb0b779f7013bd5964f15456ec1f5440dea1260066e5f165451987bd2eeba1