Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2023, 21:20

General

  • Target

    NEAS.539cedf87c373b9a0f96802a5a111480.exe

  • Size

    44KB

  • MD5

    539cedf87c373b9a0f96802a5a111480

  • SHA1

    52c9bbaa25c3c346e216b395d76dd976ad0e3bfb

  • SHA256

    c2cc8c7a1f0a12208f0aa95798049765102cbd7bfcf46fa21f7366b92653f9c4

  • SHA512

    5ecf7400a18cabea858732c321c2952425ac333d9076a389884b1eb7c0c227014b9774d4cc0f03f7835536f7aed1c8a56f5042532d39f77a7a62bdeed7dd2e67

  • SSDEEP

    384:GBt7Br5xjLvassAgA71FbhvgqHqQFLFupZr1pZriiouE7EW:W7Blp2sspARFbhJpupZ5pZo

Score
9/10

Malware Config

Signatures

  • Renames multiple (191) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.539cedf87c373b9a0f96802a5a111480.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.539cedf87c373b9a0f96802a5a111480.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1154728922-3261336865-3456416385-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    67d0721691493dc55ad253e1cd9c579b

    SHA1

    25a6afa503b1a14d3bbc3ff0d540f1d8f09bfb0f

    SHA256

    eb42f122e572907d433d8859c5b68cb9771e606e9f7b7b10cbf6d9831d0a9c2b

    SHA512

    5ce0dc7758f2d21db8a613d338d29494877451134937a3b7f2ba4cc8b42d269cc5a88d005264ef911f0015e64045393df7fa1fb70f9b1a2c308d56c8ec78d6a5

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    53KB

    MD5

    a1bce49ad1666493c610a22767284e71

    SHA1

    70ae4f3a7008946779309a476652f43368c75ace

    SHA256

    5b05eaa07fc845062d32b0a8f77dfcb4c1e223105a94b0befd3662af811d640e

    SHA512

    77bf3d6ec4a2bdcc396c60d096134e8310e3abba20361391c34b4e409ab5aa4e8581b10345bfe6e0b84d466be6d6d4917d15f9b5673090abc8c831e909fba1b2