Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe
Resource
win10v2004-20241007-en
General
-
Target
6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe
-
Size
82KB
-
MD5
850663fdc1731e7c026c98b20f36e480
-
SHA1
bd1702bdc2861f268e71048d6782912da883f894
-
SHA256
6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075c
-
SHA512
22a3d4bc4901bc236f2ea36ef3e73781e85c14561b9b5dda858dc1d003c48c69dbb7eb4dd4b8041ec7cf81f6952750b80ccc9f292c0312de05653780ee7c905d
-
SSDEEP
1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGlMr:6e76mQSohsUsUKa
Malware Config
Signatures
-
Renames multiple (4320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5e551922c1896389ccc8b3898e1a178f9
SHA150c2e4d98961e7395c9117962d76dd03ddf90a5c
SHA256aee007d52e4a1ba3abae271dd6fb1ec950d0db449332e1209c5766b17e58179b
SHA5129658033d6df3e89fecfa05721b3d1bc762cf89234270686fd2d9e1e8960e4bb0839b8b790b43f661a8a2db10e94b5d070299f2c81f46bd325fa90983f791a01f
-
Filesize
181KB
MD5e191b3eddb87c99db683a4fce48bdbcc
SHA1ec2430eaa4485ad6a331d8b03d2172d48d10f13c
SHA256934a4a83822786287a59fc485d6a68d827576d7e004813131caf86e92bae43f4
SHA5123f3aa4681cdd3c8236176a1df45f717dd7b9520550404e6227c62118350f1692f85d3e0a781c3b0b1e85054733b22fb785eba1f0943a00a003e5656e733841fa