Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 03:01
Behavioral task
behavioral1
Sample
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
Resource
win10v2004-20241007-en
General
-
Target
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
-
Size
1.1MB
-
MD5
91887e7852cdffe968fd529e3d47b4c0
-
SHA1
aa0efe7f6326f49d7633535de28d154e8ad735fe
-
SHA256
bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4
-
SHA512
761a95014539baf0a5c94ca994fa4ef94f5515145bf66d339051ccd928a5890b03038af939899f9f212aefc663bedafba650c6fbe7704ba3c669c996df9f5fb3
-
SSDEEP
6144:KbEQl/lLlHlKoJoEoV5oV0rlrgrgrtT8TBTSTQVCA2VCAMVCAmVCAbDu+6JmDu+T:doJoEo/o2rlrgrgrtT8TBTSTf
Malware Config
Signatures
-
Renames multiple (1706) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1720-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b42-2.dat upx behavioral2/files/0x0014000000022912-6.dat upx behavioral2/memory/1720-372-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe"C:\Users\Admin\AppData\Local\Temp\bb3c8cdf64b6ff70e09a10f23fbee0ae22ffb830dffc1edf7893161d0532d8b4N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5506c8b2c351d1302b62020d71d8315ac
SHA1b63dcdb9f6d633f9d12374b6cfcf77f2cbf2a1c5
SHA25661ef1614979c6d4944b37dadab9df18d4fe7018c7be788687670d380c30f79c3
SHA512def0c1297cede1fc34f3348b3a1f9bdeafa4dcb680bd67024a30d8f9e344741a20df07612bc5f9d21b759e7d3b940616b3360d3c6dff5946c2afd5cc8433a995
-
Filesize
1.2MB
MD5f9bfe0e0af7cc7a0361f43becf36bd9e
SHA195d3658e8e177ade6f2a3475918673f848bca6d3
SHA2564807747e67eb9d96818bdc61ba2998694c98933ea73a157a5dc9486f8cc0c312
SHA512806c4c686cf7c5f876aa2d399bb491be947e85e9e7930fc99d71bfd9f8a58109b864629e286e0929cfc3ae7d0f6cc7f64a27c556ca24fb39d992a8bc39eb1403