Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 20:27

General

  • Target

    NEAS.6d5ebc181ce8796011da6253748b4ec0.exe

  • Size

    370KB

  • MD5

    6d5ebc181ce8796011da6253748b4ec0

  • SHA1

    d93e00bcce5b371e7a98f7864131bf6f90079e09

  • SHA256

    5ccd390f07c1da3f45447210a1a143f859e5077c20e0baaeaa1caf812ab77c20

  • SHA512

    5be289f884fae79edc7c8fd6401396bb466aef6b5e3b61519409f170e7292b30c943cb01046d3744d63436a41f2f543df63bc60661e2f884909af38f3dce9283

  • SSDEEP

    6144:Rq+SWu0SWua57h9N+O72TRLM7rJf+pKWebwXDFz39S9B4QOoNlzz5z2:rh9Nf72TRLOf+pKWebwXNtS9B4QOoDzQ

Score
9/10

Malware Config

Signatures

  • Renames multiple (79) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.6d5ebc181ce8796011da6253748b4ec0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d5ebc181ce8796011da6253748b4ec0.exe"
    1⤵
      PID:2260

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini.tmp

      Filesize

      370KB

      MD5

      c9006a2a38bcfe742f64a374ed86001c

      SHA1

      708ff122c9d4ae98afe476b7dce89769b30b519e

      SHA256

      0471e2b4d3bd50c7fb5536840196eece94b7924e93f2113e03531760c78e3b34

      SHA512

      991815aa219964188db9f9a75c01ef32de29bd7ba5e905d01e2b29ee412dfc85f1e5d0a6d81c67039ed8a3b9f8531a46d9ec0cd53cc781a9702fcda6faa6255e

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

      Filesize

      379KB

      MD5

      b13e0683cc4f36888e37872029ebb723

      SHA1

      6e272fad67071aff226173ee1dea0a3e18512f36

      SHA256

      e0c198d22fad33c74434c88973a34b722be93f8475d2f474eaa9497fd51b1e8a

      SHA512

      006bd6597787cdcabb30d03141a3250904984a49a860d1c448eeac94dae8c610076fe476779d2ed3526211d3451ae4079f0bd4c3142be85a51ed25d73a2d05b8