Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
Resource
win10v2004-20241007-en
General
-
Target
baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
-
Size
91KB
-
MD5
5671c8bbf9e774c71417d4f5ab358310
-
SHA1
79c00fb2a4735798ba6ad68d0e7962568a580a47
-
SHA256
baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55
-
SHA512
5a734516e34085404bf6ada7cda5ea7e217be295879d0e2a9f643bfa4f999470ae921691c1ae3e49ef99c20ceb712be6feafdfb6aca86cb188b4700bdeedefb8
-
SSDEEP
1536:W7ZhA7dAZ1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGLtErm:6e76mQSohsUsUKDtErm
Malware Config
Signatures
-
Renames multiple (4135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe"C:\Users\Admin\AppData\Local\Temp\baaa06db9b071b5b5fd7aeb6d96e210d58be34230e1212e14aa8590505b6af55N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5678a39e098b2e9ce860b577e234c0148
SHA179f4b47c13c630a8de989ae56175b0d11e1a7047
SHA25640ad2cdb4768f0f1ddf42a0e115ff2da5f275a6fdabcd804f997eb949c49e3a8
SHA512712f6eaf40d7e6d4eecce870712d5c949cc4547b00bf0d87d7a8239b35db3da469bf360c2f9fae0027add3b3e3178274942bbe6b9a68a94148ada06089c2adc2
-
Filesize
190KB
MD5fba159705ec1bd6b6bb11c2474eac5e8
SHA1a17fdca5647360b845f258d11070b274a76070f5
SHA2569c06949b767276b2b068f73e71550c270f0435922a2364208588858e8e52b70c
SHA512a53d992bccc7eca6eccb79ee4346e90192ef4e838742c4f822e0e8499eb63937fd35c70328fccbbc5f7daea63f6105a23f6e1eb0ebfcd813131b760b99a08821