Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 05:47
Behavioral task
behavioral1
Sample
3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
Resource
win10v2004-20240802-en
General
-
Target
3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
-
Size
61KB
-
MD5
87337807eab6f759ef4441f2774c04e0
-
SHA1
b48daba0525d67c123f8f294bc9238a4f9998240
-
SHA256
3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381
-
SHA512
76f5dd8d294643aa9a393774f803d2b063aab11f5acd0effcbf8540c8e4064bfc30f9c091cdd1b85bb6ef950558080405bc80ed50826356d69816d929caf3fc3
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0m+Q:V7Zf/FAxTWoJJZENTNyl2Sm0mKg
Malware Config
Signatures
-
Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/208-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023415-2.dat upx behavioral2/files/0x00040000000228de-6.dat upx behavioral2/memory/208-916-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\AppXManifest.xml.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe"C:\Users\Admin\AppData\Local\Temp\3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5ab486e5df9973cdd3e1241c750eeac71
SHA1d6394924456b37fc9812410a3c2c80061e605197
SHA256eb5aa783670044f3ee50d01a6d79eca26e9b4d7d7485f140d04b4304ad0a231a
SHA51221d6cb292d74fa5ff9ee0ef1a7a2d007fae2da2954567971a036fb8c22b0cce0f88c27aea211c3c88ddd57f1df521a274e6a8aa74cc01fe69afa8e74b70bcb28
-
Filesize
160KB
MD5880590cf34cc8225a4ee08e1de0ce6b6
SHA1cd3f1346778c49ba03228a3c65c6ab2e7aac1076
SHA2566e13e7ff81732d79b2f86b8baf38d62a35093af8e5d8901f261dc866880fb3c2
SHA5120160ed334124f69f02b14cf09704475032b34d90a3613adfa8e95d75af4aef252aca1cd3281670a480c89b70ce5d78d18b7521d9da5db4702056ca2967000f8b