Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 03:29
Behavioral task
behavioral1
Sample
ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe
Resource
win10v2004-20241007-en
General
-
Target
ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe
-
Size
63KB
-
MD5
7d64d8af10d2c3315074087f17317870
-
SHA1
be7fefd19d3b04b9f1708743c9b5ec68a23b8d11
-
SHA256
ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0a
-
SHA512
b3a6dce90b590fc3cbdf4076e0e5dd933718fb62695c18200ab79c8c3f657488186b586390d08c5e3d7cfeb1bebae34536963ce8e8b108b367c4f6e56c877738
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4iz:V7Zf/FAxTWoJJ7TTQoQ/IXb7n
Malware Config
Signatures
-
Renames multiple (5168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2796-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b35-2.dat upx behavioral2/files/0x00040000000228fe-6.dat upx behavioral2/memory/2796-718-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\BlockAssert.TS.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SFBAPPSDK.DLL.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe"C:\Users\Admin\AppData\Local\Temp\ca8d30c167009f3c14f8a1657b63d993d19b47e4f78690096ea2f7683a0b5c0aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5ff9eaff7569eca40fabf6a9a7220bfcc
SHA151e013ceaee13cc4c6c8d60cd81b52cb90357b49
SHA2565ce1f25cfdafd6b87ed0e39e7e626c2a6408af2ea2fd9ac483cbfd6cdc82a6a2
SHA512be8fecff3cd049408e61b2ab6da2c7205d54114fdcccd3453670d2d7dfb7970a21003463a22297ab7c652088f6107d73b9bbdc7ec5bc236a6cb131ca0b60ac8a
-
Filesize
162KB
MD5dd947deefe23c80fa59ede9b311faaad
SHA1640fc04d031a93158102c1a3fc941dab40b26fd5
SHA256d47155855d1b94a7f28b2ac6dc53070c46e12d1414081dbbcb68b5ce1aa990e7
SHA5126d0f0b526a64895246fb024048b706f9d304bc54132bd267c0da728faba2468cc1440ae23a087fa3e8b057febad53a2458190b77fdba94346bbbce42b42c877d