Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 23:40
Behavioral task
behavioral1
Sample
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
Resource
win10v2004-20241007-en
General
-
Target
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
-
Size
39KB
-
MD5
edf7396b85137323ed9a373a6024adc0
-
SHA1
97135bd8c118ee142effb321b675624548ab36ca
-
SHA256
c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43
-
SHA512
f162b902d6aa8d481010774679531a670fa9936297dadaa8cd7df3df53f6db70fef7c5365e1e46928212c17eb746f3fdecd6a17fc826bba124302373cf956f6f
-
SSDEEP
768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJEopodSox/6Sox/9j:CTW7JJ7TPUTE3
Malware Config
Signatures
-
Renames multiple (5096) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2648-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000c000000023b40-2.dat upx behavioral2/files/0x0004000000022916-6.dat upx behavioral2/memory/2648-789-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\BackupNew.avi.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD54e5bdfa5bc2d95d8bfe39e8c6197289c
SHA156ffbf260eb53d546f3caa0b6268f3b067b88f06
SHA2564b9282ec8e6c02c210954ef5caa1dff4789d111e0ab549c62ad5a9e83f410c80
SHA5124b96544f151631d533e5f1929b4b4ba4355fa24bf0824a09b5c1197528e331af59cfe781d41f5b24ffcbdef72d50a5522dd7f25ee08d197934ade0a081a55263
-
Filesize
139KB
MD536ce144a578a3e7863c5195e2d553995
SHA19206b18b568d86617f59db4ca6562030e63d3b5e
SHA256faf8c1b5c559ee18716d738099bebff65a56fe4f8bd5f55ed07380b541502d18
SHA5127ce4997e779caa725237f7d0e07d751e35885f4b0d997a2189e1e009328405833d0bdbc8eba31c35d4565e86d59474a56d9697eb6db13420e83f320eb251d0e6