Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 18:08
Behavioral task
behavioral1
Sample
59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe
Resource
win10v2004-20240802-en
General
-
Target
59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe
-
Size
83KB
-
MD5
a43f6b61103eef3170b80a11bd76b3f0
-
SHA1
785f5b64da5a8ea56e8d9d1188f4a63b52657de1
-
SHA256
59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0
-
SHA512
ad2c67882fd88896c18a10e1228d489eb149c532c8cc51b8acbffa18bfb654f24637e2446e86502e5f07c85b9d85dbf6d022a634608e6d0fa2cb7fa39a7e5c57
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5C:fnyiQSox5C
Malware Config
Signatures
-
Renames multiple (4542) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4464-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000233c8-2.dat upx behavioral2/files/0x00040000000228f4-6.dat upx behavioral2/memory/4464-872-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe"C:\Users\Admin\AppData\Local\Temp\59a16aff8fd7bcf2754486819258fae636589566ba1d727bc3fcc161f9e96af0N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5f0e28092e3f2aed378002dcd2118feb6
SHA13ab2d25e4b8210da5abcba725e9f621d5aa45831
SHA256c1689952e7514286599dd8cb2c1b0e81d7556acba05800d43a880a22b8221672
SHA512244e437c1678a448e1bfa0c593b7dd22d63b8ff63d592c7d7af8488b9e6167d6ea3c819472462ea4d2e66f9124afb25d583f22e95ef3ea21c6a585ae01ade513
-
Filesize
182KB
MD5b7e3773e68aab81260f6024952c86435
SHA133996eaf5f2b058809e8f03b7a0d684e1627b489
SHA25602f00f7ff0e57edd9f6b69235f83d5bf6319d847f05aa72dd92005adc3be78e7
SHA5123eacdafd163a3b8be2c9b3598192c0e8271ef5e1093c5fe87f92ea2744563e2c0a1708d1e2492b179bf20a0f3ac2ec41f96f2adc05f6139c6a787f0cd0fa5d44