Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 04:28
Behavioral task
behavioral1
Sample
c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe
Resource
win10v2004-20241007-en
General
-
Target
c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe
-
Size
58KB
-
MD5
8208ce4d4b23aece7bb559d7291b5d11
-
SHA1
7100969917e25a118937e5988fd80984892103db
-
SHA256
c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239
-
SHA512
5c0a8a4337e8d3757e0dc5590013749b5c0131b110423b5252a31901f7f295cbcb69a1a7766db06ee373fe36e8cafea66a49679e3851d4c5ea89add5c13ad7f9
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Y4mQv4mQv:V7Zf/FAxTWoJJ7T24xv4xv
Malware Config
Signatures
-
Renames multiple (5047) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4088-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b1b-2.dat upx behavioral2/files/0x0004000000022916-6.dat upx behavioral2/memory/4088-776-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-oob.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe"C:\Users\Admin\AppData\Local\Temp\c2305250fa2af1f456efe3c2ba9a3da084f65fe8b7eab6b91b708b4cb6fe5239.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5cf4e07c0bfbee90ca2e99aaa4710506c
SHA11173166ff70fffd717cb8755a0a4ce2d1899915f
SHA2560a3ae96298237d37e3269d329b7d6800fb3698540bf81bf85a72ab5c41e74749
SHA5129f3cb39de2e7ba98cb1a4c2264c26efcb6a5373a732c5293410cff6e4d17c8a26fd37f5fd0a0cfebd85624bbce54221ef596ce8d36d1f2b0a93cc39460d676f8
-
Filesize
157KB
MD56e0d27a2282c0e914fc0c50c11545dda
SHA1027e4745fa9b435a474762df158d385a778f60d4
SHA25625db1cb02b00d93f03b1ecc4733f1eaf2707848243ded89592dd6f8fcd488e10
SHA51286be40bbb9d3d033837d8cccff1bff7262f23d10634afe38b91cbe218fa4d8fea648c7da6e296e66188393f80f672cf5ce2e01827478578486963c1a3bb1a727