Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 21:26
Behavioral task
behavioral1
Sample
45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe
Resource
win10v2004-20241007-en
General
-
Target
45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe
-
Size
19KB
-
MD5
1053b691e6697f04c3463316b0d0c118
-
SHA1
0990121c132b8042f2cd6ca172580c9ff901c6d1
-
SHA256
45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106
-
SHA512
ccf954a2357f16280a7986ee2a1ec7ca8b60e3739499c5d2ae43689043c8a88f846b095c4e0e9d277de2403dcc01f75a3abed76917cf4609d7dd7d7834766c31
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJcbQbf1Oti1JGBQOOiQJhAT17JM:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJl
Malware Config
Signatures
-
Renames multiple (5203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4052-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000d000000023b84-2.dat upx behavioral2/files/0x00040000000228fe-6.dat upx behavioral2/memory/4052-667-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.tmp 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe"C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5342b85758a1a03d4648ebf9e8cf2c983
SHA1ab02011b29b20e2bb1c5cb6d3dd2648860ef83bb
SHA256137d3e7789076a743d6f0e246399abef8351535df83dc5cccce4fc5ca2197660
SHA5128cd5f79a12e4143dda8af1c74629f08dc4fad0ab9e523ef255b423bda0460bd6c5e98d3ab7037154c8d01b82fdd87c64cfb90130cbc4b8fc8fcf7ae0c189da98
-
Filesize
118KB
MD51641d52cf612de3e9503ba4b2b33768c
SHA170e0a73e10c8d5b453455abfe3e85ec90a11e5d2
SHA256befd2e4e4baace9d4d592575224b2006ee9b5b6ee8b7523baa868c453cc9e3cc
SHA512fac3cc6aa552d607bd55d88914a8c0f89171c0ef98518408ceb4636a40f54d19bc66d8d727430025c46ca0de0ef52a4839b1e478e2ec1f005b7e2c8f41d469f8