Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2024, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe
Resource
win10v2004-20241007-en
General
-
Target
845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe
-
Size
94KB
-
MD5
8fe84ecaf9d3d85c493e0a9858a58890
-
SHA1
83d5f11dbc6403d91c8c88bc2668c406a5dab42f
-
SHA256
845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233
-
SHA512
1a68e22a68344d18a4d47731069d43805eb84c81d828cc7bfc64ff7a4d1f0ef78685c6d68da17b62ee4d2c9323a81799f6da4566312e7b6b903106f745416bcd
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh+:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsr
Malware Config
Signatures
-
Renames multiple (4228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe"C:\Users\Admin\AppData\Local\Temp\845f3ce3ae227455485d22aa5020e8319adeb2fd3a2dfcec052c2ad8ad18f233N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5d89a4c6bae810de4cd9a111bee4a7260
SHA175757b262b90f8f9afe1feaecb9cd6a4099d9229
SHA25632388d7a56f236ccee520369bd87387a54ceaf1de4e27d5bf4555c7c00835307
SHA512b117369f8a6a215e6c53816ef3df61a6f28ba34fef6805162376013bc93d7c17f215adebf0a0adda9aec4dd5aad9f6292e811691d3ff89cd114113126714d267
-
Filesize
193KB
MD514946655c5aadc0b1bec3483b6b5ef37
SHA1e87fed37e0359b569e89a1d143ffe462ebb5bceb
SHA2565476af7533b0486c068e8d8f1f967c3d949857388de3d8edbb32bc535a5bf580
SHA5125ba9de81ba28973bd46150e7789cf2a4439a807f42b2c6f60218c310968ed7e8ae7dadb038d051c779ee8a4f3c6c098dacd3b2a0a4a5f708585668c6833f9022