Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
Resource
win10v2004-20240802-en
General
-
Target
155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
-
Size
52KB
-
MD5
37b65f86aba2dab93dfab47817eeb270
-
SHA1
37d994fc2af4770d74ad80126dce4faf2c604a21
-
SHA256
155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37fa
-
SHA512
932106594abba02e909e07c278864823b039b46547adfd1303b84bfe79983ca2c45c5ec66f6d91218979beba89e6cd358613ae91984d1f0879f66b6a3635c7b5
-
SSDEEP
384:yBs7Br5xjL8AgA71Fbhva4S04Shk5c5iZGba14:/7BlpQpARFbhS101hk5c5iZGbJ
Malware Config
Signatures
-
Renames multiple (5249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\7-Zip\License.txt.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jre-1.8\LICENSE.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\EEINTL.DLL.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUB.TTF.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALAB.TTF.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe"C:\Users\Admin\AppData\Local\Temp\155af7e68c9240026fe4db7deed2611c6d5641641f8d295ca1565eb4718c37faN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5a94c0ee2a6bd69da5656836dcb7b838f
SHA178c8c9f635be5d36d80c7991fccfd84b56e9f0d3
SHA256462840a3d4dd7b87c0003a0b2d8a19d65672dbb98b2013c024dbdc1228b11888
SHA51219928779c6475324a829dea1a1b7a4891d1097496ec6bd8feb72a2a135ca5071d4013eb1f13ec2f769ef5a6d4f5cc1c14000c173118c50b7931a5e12328e38b6
-
Filesize
152KB
MD50a73934006408c34a5412ecb9dad2a8e
SHA1ea4da36c80eafc427798e53eb3ddff6695b7fc26
SHA256c3465a55b83bf64d21b7dc9a713aaa713206fd014c8da8991782209daf6c8fd2
SHA5124db9b3d1a0ec58b68da4fa944844448841e5ff5dd55210fe20850c2e4972af3b603d84084fbf621563e4f2283eed884f432a07435c4c400f119632540fecf940