Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2023, 12:54

General

  • Target

    NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe

  • Size

    142KB

  • MD5

    126928b77dff7044325e0bdec4e7f5e3

  • SHA1

    a247e86e8355aa29ae31761716b478176fcbbf12

  • SHA256

    c79152d9adc8c8dbcbbce09fda509871d8db22aa2ceeaab2a683caaed7b3f5f0

  • SHA512

    e4364f1ec05fcb5638acdc418cd700f1d5e9b073d5a283ca8d16edf100b9a2562c11ba5460732c36693efa709694a810353c2d647cf3be808b4a3544b08b3020

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9iZ76qupFg9e+eTSj:RqlIyFESWu0SWu86jYYFg9e+eTSj

Score
9/10

Malware Config

Signatures

  • Renames multiple (246) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2084844033-2744876406-2053742436-1000\desktop.ini.tmp

    Filesize

    142KB

    MD5

    0c1c5e5e3c5f87e5b1fa392551146a50

    SHA1

    0777082aa9f61ffd4d75bc97deb12a4c298688c3

    SHA256

    3f51c396e9f92e9d43a9f4a39a7b4be45fe7c379d6842975c736ba424fd71e92

    SHA512

    7c2e5e12f008a19eb71af21a812b64d98f44b36d1b8d9af5ed95df091992e9c764a237c1bab2874f0346c712d22c1d660c4c505e246a437803b68fef987505ac

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    151KB

    MD5

    ddbefc84f6ee7967ea5c4fead2bc1a99

    SHA1

    3e6f323d6171c4185eae91fb3455f83f576e6122

    SHA256

    84547697d421d4fa22af50436314a2392a86424e49c5987f8491fa47576ef782

    SHA512

    cb878068bc55699f051cd7cc7d4651b726ca3747b8d36ec65601474230fd72ff40f01fa48bb78269306a6a442d7d8a7816828bc392e761ad355f8b0933eff44e