Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 04:04
Behavioral task
behavioral1
Sample
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
Resource
win10v2004-20241007-en
General
-
Target
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
-
Size
53KB
-
MD5
880740c22dfe4bf33f150712f1a7b0db
-
SHA1
300fb3138f837edcb60fbff674a4630af9d359f3
-
SHA256
ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe
-
SHA512
ef9d7f03df2bd3b399e37168b143c91a241b68f0c4f797877360c1b8ff25af4ddf09f45696ca0b452faa39cb52f3cc619fb30204e4d5453d6e7205ffc4f1ffa6
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9X:V7Zf/FAxTWoJJ7TJ
Malware Config
Signatures
-
Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b93-2.dat upx behavioral2/files/0x0014000000022912-6.dat upx behavioral2/memory/1536-784-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7-zip32.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF.tmp ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe"C:\Users\Admin\AppData\Local\Temp\ba9d952936e9de1ce4c4d9c9dd4a031bbb90b530e1ab6749d4cbaa2c8b46aabe.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5d70735a3bd851f4bb719376292a3e28e
SHA1898876c043589fd7428a4c4da629858e1c35683e
SHA2564d6e0168e0b9ef74c86c78a6f68b3f8cb19554eb49573ce0bfc6efac7edc5520
SHA5127a401b65295dfaa77bc1b1d8b3e70a55a56b465b87a33494bb16f04e360e9756e470917553d97b808bd91c2f0e562ad5229d7e3e4d6b7e172635cb7a67e2066f
-
Filesize
152KB
MD54e33e83affc35114b0d90eb16af610c5
SHA11a94386ce5cf724d8e09ce8128429eff15dfe2e5
SHA256e65ac7b3ecbec517b7aed23a2aa52428e6e9a325d9c2198c13ca0130e673326c
SHA512b2c9e1febe7c72ec8ec52f1764a2b3a9aeeed7e762cc8ed3ce1bd8bd84d89576712ae182167a7ac5e2e02af2302d238fdc22503ac70e5de9e7fb78aec2d182ad