Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2023, 12:54

General

  • Target

    NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe

  • Size

    142KB

  • MD5

    126928b77dff7044325e0bdec4e7f5e3

  • SHA1

    a247e86e8355aa29ae31761716b478176fcbbf12

  • SHA256

    c79152d9adc8c8dbcbbce09fda509871d8db22aa2ceeaab2a683caaed7b3f5f0

  • SHA512

    e4364f1ec05fcb5638acdc418cd700f1d5e9b073d5a283ca8d16edf100b9a2562c11ba5460732c36693efa709694a810353c2d647cf3be808b4a3544b08b3020

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9iZ76qupFg9e+eTSj:RqlIyFESWu0SWu86jYYFg9e+eTSj

Score
9/10

Malware Config

Signatures

  • Renames multiple (951) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3777073499-70821052-905318652-1000\desktop.ini.tmp

    Filesize

    142KB

    MD5

    837c8c527a0ab6c36333e0642e683fbb

    SHA1

    db4e7d8de858d82405e8821d89b6110ccef0fa37

    SHA256

    fdb608a8b86f75fa36be452a9aae2fef34a4bcb901c2b44f3d6afa435eaf91b6

    SHA512

    6ee8a5bc71e0768c77e057dea5bb87810a91a1bb42c471d516d9f980a4c6175508c8edabe3246abb4595774e9ff254dd278b92b8325fddbeb72ac102da1a3016

  • C:\odt\config.xml.tmp

    Filesize

    143KB

    MD5

    192a808f67fcd5858241c612cbec0c56

    SHA1

    1e150b1b7c3fa78a99514ee0d62b3b60dcd29ecf

    SHA256

    a7c951175035eff4a109f9d63dc1d2370af7a2dcc4253f1ab3670befd220f4af

    SHA512

    8d7fe9f98a27e0552714178a6dafbbd9ba8dbbc878deaea3d3a6248ef6a5db9b5e54444d46ef5b7517518749153ba6355ba90136f01eb9ac54cb6221efe2c576