Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe
Resource
win10v2004-20240802-en
General
-
Target
538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe
-
Size
48KB
-
MD5
61d8c2ff44ec9b9bbb2f3ab337e65070
-
SHA1
36c9df61711dbd3d651bd12c637fcce56d90c369
-
SHA256
538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23
-
SHA512
cb0b904b270c30bd32bf4820ad6ac7cbb272192462e8e0c8dcddc5bfdb8f818286088da9c848b2a9237d17ab018989db76a12ab4c01ec748bbce1f0c5bb8a7d1
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42Lcfpb2N231F1ngig2/Gum/Gu/:W7ZppApBULcfpHLcfpSo3f2xf
Malware Config
Signatures
-
Renames multiple (5087) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe"C:\Users\Admin\AppData\Local\Temp\538363bb4651942f7fe0da058e6301b3f54c7e405d7a47a6d2f2988e5b742b23N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5c544c112cc944e8e8916c0754e99eb64
SHA14355641b641aecb9a7c727bdb48c186036217290
SHA256bf689582faa375389311c7a709d06e5d7421e78b21f5e3f9697af8dc924f89bb
SHA51262c5aea188fed20dce41a3d7c985ed18a8096ef5bbd27ae5d10a436cdd0fa61d0f8df317a0cd9f137a54a7c604246c01ad5d0252a1661fe577bee22a6c719b96
-
Filesize
147KB
MD51c17a959c1464ed18f6685a409d9512d
SHA168ef6728c815258139d620f5b9d9ea146307f895
SHA256b0e03b3a9f425a4f7c35702f070e6536b039f1732f61482d0c59b543da5e0d2f
SHA512b9496c19d1da46593921dcf7ee2e3f68399a28ec7dc90f8751f756ca84e55bc2ec33152d6c021e548deb7d0f3076e08ea11a6d49bced5fd28ff1e0dc6ea5cd39