Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    174s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 17:53

General

  • Target

    NEAS.4691d16c72f90a198cc310147e2a5f90.exe

  • Size

    59KB

  • MD5

    4691d16c72f90a198cc310147e2a5f90

  • SHA1

    dee738a862a439f7942e8517f343f1ae762fb434

  • SHA256

    962e0585d634cbc73b8850dac7e45d10421cabea3847e2d54d15a8de01a28f8e

  • SHA512

    8ea2758a2c9d08df9077d59e7bf2f551d7d91283e8d14dd3a5defe240865222ec0a0a27e2d1cf652b4b67376c73c20d2f9a9cdf4cb68c9f034cb9d4e582cc4ea

  • SSDEEP

    1536:W7Z+pApfGQ3y3RWsryOFTcTSbyEmOTcTSbyEmH:6+WpArfTcTSWEmOTcTSWEmH

Score
9/10

Malware Config

Signatures

  • Renames multiple (267) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4691d16c72f90a198cc310147e2a5f90.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4691d16c72f90a198cc310147e2a5f90.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3513876443-2771975297-1923446376-1000\desktop.ini.tmp

    Filesize

    59KB

    MD5

    f83c55c19dbc96a4498016f5934030b2

    SHA1

    68f22dfad995fa2156d819c9efcfa572b523a88b

    SHA256

    effbd8c676106d53ffb1a92948c263f190e46de5d3b10e3390b435218f13fa2c

    SHA512

    dd3d485dca396d3e1cc1776e556c742669e8ba0eb427d1ae28ea9e46ace5fc13ac2451d4edcf039f50d0af9828f2e8b2f2b589719819a35575c08b6e3e403230

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    68KB

    MD5

    b8f07dab5957270194cb8a5bb5fa42cf

    SHA1

    5c708c388d2f2edb1d74106eed126fb18ff46906

    SHA256

    4d3ece33ce8d8c36d721e4dd3d28fd7559dc226129836811843766453dcabfaa

    SHA512

    0e30b1b9764a406ecdd17c85d56e81b18509e008b2bbb1904b559d44d60e29dab776657e53f249f2536be19f1da5625f919df4e416418e5ec053201136a30c94