Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 23:37
Behavioral task
behavioral1
Sample
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
Resource
win10v2004-20241007-en
General
-
Target
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
-
Size
39KB
-
MD5
edf7396b85137323ed9a373a6024adc0
-
SHA1
97135bd8c118ee142effb321b675624548ab36ca
-
SHA256
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43
-
SHA512
f162b902d6aa8d481010774679531a670fa9936297dadaa8cd7df3df53f6db70fef7c5365e1e46928212c17eb746f3fdecd6a17fc826bba124302373cf956f6f
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJEopodSox/6Sox/9j:CTW7JJ7TPUTE3
Malware Config
Signatures
-
Renames multiple (4287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2396-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000b000000023b8b-2.dat upx behavioral2/files/0x0014000000022905-6.dat upx behavioral2/memory/2396-658-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\CopyResize.au3.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD56f5594b379f5395504d43f9d9a4a216b
SHA16d58e6ee1ed01ae8d440c1866d179f9723f2e6bf
SHA2563076b15b4f3e7e1215544c36f9cf587d290aef4cca0d3350b8c8b79f5049d52e
SHA51242aa68517f658d8f94d756548c61633b3054fd7932b29ada4ea570fad1e71882ce74d976eff68d002f8e6f856d6f140106bb587081f38833b9d1de37d96f29bc
-
Filesize
139KB
MD5cc8683685556609feaaa9a730c55288d
SHA144f3238de96de9d883af34177626c6e789dde7f8
SHA2568daad7737530dfcab6be44853193fbb9a6d3fe270b9616c9842a2d9bc16d8a3c
SHA512e5e5a5eb05868e2190126829e838bcdc81f595e46986f06513d5fe46499ba47a037815047bd1c3c6410e61d7a64b9d558299ffd6c60c0e873eccddc035b06c80