Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe
Resource
win10v2004-20240802-en
General
-
Target
797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe
-
Size
47KB
-
MD5
abcfa0a0a1a2a2f61382e5d8da2d8af0
-
SHA1
89c95ee268908683247754e47b154f47e4c1c7bc
-
SHA256
797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5
-
SHA512
daf3b4420e151301590df2bc4cd5c7fcb8f7ff471b1aac843c829c2d94ce8f7e768bdfe4040d8bdf2f50ca7d4d679c3b7e131724ba73033b13730c3fe4054ebd
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFjqAJLOqAJLkEJk:W7ZppApBULcfpHLcfpyD6k
Malware Config
Signatures
-
Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARAIT.TTF.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICB.TTF.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-LIGHT.TTF.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYH.TTC.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\AssetLibrary.ico.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe"C:\Users\Admin\AppData\Local\Temp\797e2a5897c7c9bc1212affa4ae9ad21f7a148bb975df4088703771d8bf798a5N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD57173c53262036bfbad2297aff71cd9b7
SHA13025d7702577730f74b4058fc1496f0440b21426
SHA2561b755f1b0352bf86ded5f252ab67d096b50f8f1ff4419cc04e13e7c70bd0620c
SHA512c4d56296393a0b0d20774fe5e45aebb97165e1769c8781aa82114dff436e49e3385c2af19bb5a725ce8fed255673646876a97a3693863dae6377a3b6774d930e
-
Filesize
146KB
MD5d75e783f5cde5e933fece175000b4364
SHA1ea2920dc57af6338ffab5d8c69160a2a3d6280c4
SHA2562ddc50aaf77653aeee239861f53723bb55b9b149fc23f5c815af657559aff667
SHA51228e1ab19fbaef45a17ac93948bb6934626b05855a262898fc8b24ccdaf32992efbc119ba4de2ca044d527370de725dde3846202d9e935f3d897e83385e84a828