Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 03:58
Behavioral task
behavioral1
Sample
d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe
Resource
win10v2004-20241007-en
General
-
Target
d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe
-
Size
44KB
-
MD5
f0d2d068d786e861a6baa64725cde210
-
SHA1
b531fc8f54f345a373ee8e41ff0a653310827ec4
-
SHA256
d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7
-
SHA512
8cfedef47c6ead54035fd645d4de829dea1a8df46f6d09c506593720f6ea20275a844ec9cb70e7730d9f78ce5656e32dd95075839afe8ab9596b3a8310c504a9
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti0oj1O4ixJIfoj1O4ixJIRgP:CTW7JJ7TTQoQ/IPgP
Malware Config
Signatures
-
Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2444-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000e000000023a3b-2.dat upx behavioral2/files/0x0004000000022902-6.dat upx behavioral2/memory/2444-787-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\mce.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe"C:\Users\Admin\AppData\Local\Temp\d5bdef205d2881d1ce1af2d9896150b4f24892e7b907947a4c0c24ee88261ef7N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5900bef4f533ac0f88290121f5563fd7f
SHA1883a65c95a3f0077179715ef16437e0a3b8d7a26
SHA2561502c47541cc213dc33a6c2c69c284e0d8435bf6887bfb79591bbf6e9984f3a8
SHA512e3d344b344de588db49e524d1625e59b96b32d3d7857b51ac2acc61c622829c935c20faac0f157c855010b305bd086dedde846184d38312fc16636d67be31fbc
-
Filesize
143KB
MD5d1fa18ffd6fe3af54094a9e1276f861c
SHA11f6a27861c915092cf4ea554fffdcbe197f809d2
SHA256bc4f0d12bc0f006ce07300a368eea9e603499bdeebe5d1bc5effc25f7abf90a3
SHA51287704ad9747cfe38aedacf628394e9a6f7e1cb706199db15d40b41f24dd3913be2d8720a4e127ad6f8403390b9ef0bb0ba05eaf4f84b5bf32d9892b5a2e2e456