Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2024, 00:31
Behavioral task
behavioral1
Sample
78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe
Resource
win10v2004-20241007-en
General
-
Target
78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe
-
Size
64KB
-
MD5
b0907e7f0d00fe6aa00e79d14fc040e0
-
SHA1
b65a5a0560c1c7957f0dbd831ca9524b838e3273
-
SHA256
78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315
-
SHA512
9cc0f91a8d17ebbe62b87b7bfa40b1f6206740e8efdaf8409e90bbac478529b646f30bec1ad32a7a11efbbcad6ec6570eff257243c2f4c9e06e009aa5c772f16
-
SSDEEP
768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEUI0n0uI0n05:V7Zf/FAxTWoJJ7TU3n0Wn05
Malware Config
Signatures
-
Renames multiple (4318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4840-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023c57-2.dat upx behavioral2/files/0x0014000000022905-6.dat upx behavioral2/memory/4840-656-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Google\Chrome\Application\initial_preferences.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe"C:\Users\Admin\AppData\Local\Temp\78cddecc1b17fcdd1b874dbccfc4494494712349f79c488a5676ac46bceaf315N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD549c998369bac04619ba43d7b711eb279
SHA170dd2290eb0b4bd46d21d442419b7401568d1e15
SHA256d829c4d85e9ebcf57df701b9aea572a03cdefe45859095fcaab5155816a2ac28
SHA5120f35592594d4e169fb0c5e1877c9a01eb24a7d72442bf3401460bdd2400f711770367616891e28b233fb6db897ede00d2d14f06e7fbc13e6b3136bf08ade8500
-
Filesize
163KB
MD51b5ec9b3010d14e96869c1e1c184812e
SHA1b97954d05bfefc3d83bc5ab51fe9ec29e0fe862d
SHA2563ec28e6f395486f782f2028bd7d13179438eee980a5d993517a93688eb0b89b1
SHA5124a62d8b8f06650b9f22f0ffd0fd9c0760ef8d0afd22c40b9e74bc911b4ea8e742b6fa8e679bb4c215e4777664094983c86e4ca091168500bb499b58312716786