Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 04:48
Behavioral task
behavioral1
Sample
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
Resource
win10v2004-20241007-en
General
-
Target
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
-
Size
73KB
-
MD5
8989d069cd157ed8b87d3c3e8a046c20
-
SHA1
0d6cc9d02cb154cdc12ff6513e0b46bce960bcf2
-
SHA256
be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1a
-
SHA512
6eb6b25c6aef762f914362a125b7a9ba775f247eed04d9855f8a887a41d40d3c054c52fef6a695e6ec2161c49802209545a79596674ca1406a625bf0d91f2f6f
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiJFEFuodm:V7Zf/FAxTWoJJ7TTQoQPyPhehv
Malware Config
Signatures
-
Renames multiple (4529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4800-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000c000000023b1e-2.dat upx behavioral2/files/0x00140000000228fc-6.dat upx behavioral2/memory/4800-666-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe"C:\Users\Admin\AppData\Local\Temp\be9d861bc507bd325284fe1ddb5eaa184a5f538f4ff4fa37bd362d981499ec1aN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD547bd8f5e2abe3d820016cd3127ae85ef
SHA16da48a2c8b44ed4e70b86b7279856a24e8370ae5
SHA2562349d7f33a72afcbcdd0c44a472761a94ea02543abfdac5b96ac7a6416d1cd40
SHA512b4135f8e606139b2d0f19d873c4f04ab644e58456fb0e840e035fae5e240231e14c165006c3c97ed24e75feee8162339407c2398839334c5cd31eb0cf4e07fee
-
Filesize
172KB
MD5e6d42b92ccf76f993269a1879acca5d3
SHA193a25dc64be4d21d8a5d425b10fbcc0dd0b48994
SHA2565c23dd7a0286e548e9d27c8a209c183f7e7df975defdc38654b10003471ffad7
SHA512dab8ae6ea1c9b001a373c1ae90cecb215f0fc84b0aa67f43503b74a3e4d283ae5e75efeaaa56aea466db551fd98a98ac2dda8b903b8b839a59ffe253aa66fad7