Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

NEAS.9ba04...40.exe

windows7-x64

9

NEAS.9ba04...40.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    66s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2023, 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.9ba04019a9acf989b88dee4118597340.exe

  • Size

    122KB

  • MD5

    9ba04019a9acf989b88dee4118597340

  • SHA1

    6ba1d04a25738eda4d8e48fa2e696799917d101f

  • SHA256

    6d47db000c80b45e6fb8f6d1614b51879f4c31aeecb6571ad3a697bf4487a538

  • SHA512

    c64d7adf897e184d22d58f34b5f3f97dc50e7fc98987c4a428218d81d254c87b80da317cdb36e34bbcd71ac52effbdc0d1e5cb49020d5438b437d8177c8b3d49

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmSXrw3Mtr0s8Pu:RqlIyFESWu0SWu2s8Pu

Score
9/10
ransomware

Malware Config

Signatures

  • Renames multiple (81) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.9ba04019a9acf989b88dee4118597340.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9ba04019a9acf989b88dee4118597340.exe"
    1⤵
      PID:2388

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini.tmp
      Filesize

      122KB

      MD5

      fb080bcd791ab4a8ad2729b17fa180cf

      SHA1

      d3d93ed9c6a6b680f3bbb3abe24f8dd3d7c41271

      SHA256

      8d31a6ac875d55ce0e1958e4bb82e5ad6ab8b712d47bba18e8daf35b00e67c9a

      SHA512

      35ccd7b30e0fa3be92cd434457dc19f4ea2ca6e91e200e0da7a55611a3bba0a5e4298885a9b3ce17368e7128f2c552c7fd21fd6d2cb72058dfaa3a6a4573fdb4

      Download Submit

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
      Filesize

      131KB

      MD5

      63d645a9c55c244ed542cc28489e485c

      SHA1

      e002086d14719fba492afab7d2240708e05184c3

      SHA256

      c6ce5d5b88c3178d928de8590d08a0a33775a0d8a7fca9a8b2c4aac64ca30ca1

      SHA512

      f7f93efcda2fb2e2d28245bdbe8dbeda2aa60af9443d450e0e130cf6e289d067ea48894561e316327c6e13e4a4a3a5f8199850795ad780b015f3129f76f95b7e

      Download Submit