Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/10/2023, 17:24

General

  • Target

    NEAS.9ba04019a9acf989b88dee4118597340.exe

  • Size

    122KB

  • MD5

    9ba04019a9acf989b88dee4118597340

  • SHA1

    6ba1d04a25738eda4d8e48fa2e696799917d101f

  • SHA256

    6d47db000c80b45e6fb8f6d1614b51879f4c31aeecb6571ad3a697bf4487a538

  • SHA512

    c64d7adf897e184d22d58f34b5f3f97dc50e7fc98987c4a428218d81d254c87b80da317cdb36e34bbcd71ac52effbdc0d1e5cb49020d5438b437d8177c8b3d49

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmSXrw3Mtr0s8Pu:RqlIyFESWu0SWu2s8Pu

Score
9/10

Malware Config

Signatures

  • Renames multiple (1717) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.9ba04019a9acf989b88dee4118597340.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9ba04019a9acf989b88dee4118597340.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-356073083-3299209671-3108880702-1000\desktop.ini.tmp

    Filesize

    122KB

    MD5

    075812604d38539212ac485b85775361

    SHA1

    853b285252de34ae38d62b8a504f905379f27402

    SHA256

    65aa3a660dc1851c4850ded0ba0938be92f20c73fcf02b653579441f970438fd

    SHA512

    8066dd367a4454add940eab2165c59b7a06bae471bf44fdd85b1f7f20e4d0970b2a1de3777b2690f78f13ef63c133828d498eeb8546d7d39b0d9fe713f568792

  • C:\odt\config.xml.tmp

    Filesize

    123KB

    MD5

    af63ef5e437d65566be62ceb4df56ed2

    SHA1

    ad535dfbeed950a050edc857287b0d747f879a5e

    SHA256

    ac7e02c6ac919222b912ffa17bdd75132baad36c95a68cf2e44c94d2b1861584

    SHA512

    29859c20b8e66dca69abc117ac7efe2420062d60f9a863e4ea0518101aaef5e17072b694c0d8b548dfca473ef5964fd5b0cadd74a3299bd6ef03304a7ddab60e