Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 22:29
Behavioral task
behavioral1
Sample
1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe
Resource
win10v2004-20240802-en
General
-
Target
1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe
-
Size
29KB
-
MD5
fd8b750646312cc62b65667afcfaaae0
-
SHA1
33fe7f3655eff2b9a902c100602edacbaa3cae2f
-
SHA256
1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2c
-
SHA512
5adebd2cc188e46a667099a42bc5fde013c5dfb871c1678afa05f3c1dcb6eaf053ec531b641b8a346805c62e3e504b5631166a4a21f7fd2b9e599589c420fd36
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9yGH5BH:CTW7JJ7TPTH
Malware Config
Signatures
-
Renames multiple (4673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1596-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00080000000234f9-2.dat upx behavioral2/files/0x00040000000228de-6.dat upx behavioral2/memory/1596-1001-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe"C:\Users\Admin\AppData\Local\Temp\1fd4f12237ced5b6b1cb0ecb4b09e9d88bcf0981f6d02845042f7cefc45d7f2cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD546f45c7e1c3cd0c472c29ac06336d5cc
SHA11904f0932b2810213d0d3775834fa8c87a54ee26
SHA2562d368d983136731ae39d3d6aa679cffb2683e9028d889bc71f2931f2cbc252aa
SHA512e0f00ba7368b0a3b01f0f348dbe876f089800bd49b3b74997f58ace2feabaa49ddd4c6a8b611e10f0ac4f1af6735e5ac654e9b374dc211c0063f0d1ea472f226
-
Filesize
128KB
MD548710b889afb8121717b81ffb67eb2f2
SHA1493f8a723e22b3c79a5d5252d13050f588f13fb6
SHA256c10d1222c88ef854afc2c6e06a96a24767dc2620257c9feda430b0d7c53ef68a
SHA512bd28fcd2f0453b076f7906b9a663ead232fc8598e3ca7770119bcd2f5c47839343787da8d8f96b0147474e7f87b453d245490f8498fafdd77cfd3e327f22f655