Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 09:39
Behavioral task
behavioral1
Sample
b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
Resource
win10v2004-20240802-en
General
-
Target
b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
-
Size
53KB
-
MD5
8b86c2a4e574351fc76dd3048902bb60
-
SHA1
51ef262bede951fa5290bb9d897a6d71eea1771d
-
SHA256
b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3c
-
SHA512
5ed35c5041afe3b35df453f8207b92be5ce21caae12e8a2f59aa565ea713e511c4fc274b69498b055f2db3e25c27e295ec29adc1f3ff122cbfe7149e9263f37a
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEC:V7Zf/FAxTWoJJ7TUB
Malware Config
Signatures
-
Renames multiple (4512) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1640-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002344b-2.dat upx behavioral2/files/0x000f000000022902-6.dat upx behavioral2/memory/1640-864-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe"C:\Users\Admin\AppData\Local\Temp\b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD54ea700c86157026fa3321b446311ed2c
SHA1a1b12b3f871821c404bb0b24b9db7ec7898d2498
SHA25652cd8af23a9f5e9b284451c60f3df6acd1834a657b14796ed5b8527ae3633558
SHA5129907d54c0bc157902278d13fb8889d3be39a4f92b9e267201946d9a84c78bcca0ceaa6426515a2a50043ba1be0479685887604e3713ceb6e0b0b742ea1bebca9
-
Filesize
152KB
MD5c1789ae15617ee9ebfb18eb22f4de4f9
SHA1d066a378a681a56d495c1966359d8a50f92d01be
SHA25627b7d977cd8eacc10b483cd5ead3f3a8f717c3dc5052cf6c7694bb4795c68ae0
SHA512702180d1f9dbd50e6f5ad283a1c4f6788792eb2ec1cecce44523575d6219f65ba2fc6211570a492c46cbf53c73149d1c3f9bcd7be07a732d9dfaaba34e022f6a