Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 03:17
Behavioral task
behavioral1
Sample
06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe
Resource
win10v2004-20240910-en
General
-
Target
06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe
-
Size
61KB
-
MD5
ce7356ca32b462082067b74c220102f0
-
SHA1
a62a4dbd4343b4c76aed07c510d3a586566cd94b
-
SHA256
06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28
-
SHA512
d97bb779ad69a5a148baf386e51753b8afd7e63b8e92b5bb9b814d326dcb42338128ef6e9eb2986311fb92dfb354bedef52e1c32a50e83c527aa4f9de95e0d20
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Hx3R9pi1xOR9pi1xNXVA:V7Zf/FAxTWoJJ7Th9ko9khFw
Malware Config
Signatures
-
Renames multiple (4615) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1964-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b1e-2.dat upx behavioral2/files/0x0004000000022941-6.dat upx behavioral2/memory/1964-716-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jre-1.8\LICENSE.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe"C:\Users\Admin\AppData\Local\Temp\06f7892ea6bea5be615ed9454f5beadff6526648486615117c4a0b7377f56c28N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e319177bef1b9b39fddfba151d37ed09
SHA15c2aa81dd944575a3f3f1e30c80e7eb014ef4bb3
SHA256b330180f8a49244f1d3492584a2772bd14c2314ac6198302c7fafac18c2bf98f
SHA5122d016e0b971a559c119a8d21451788fe1abd9c9c2a2d38fe9697844efee5f33c6b38f40a68479145858c7bc39aa23e522d9586d0fb14be649b4bf95d90c0cd69
-
Filesize
160KB
MD524f0dba07ce96a60592e77c9e5f3387b
SHA1cf455c6f4bae280e88e8cd5381bb28127b7e5824
SHA2561888e0ed1e448a1a8643091cb68fb24718cd6a1caee018b0b696cf4680e9feb2
SHA512516c4364363d2044b0bdda73ed8c5f1119fed911e35e8c40b13c06ee2df53f37357eae8bfbf791764ce58bbaf30390cc0c430b8ba5e5f865dc227d1beb35a8f9