Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 03:50

General

  • Target

    NEAS.5b83e0964251410fa730051e3c5fdda0.exe

  • Size

    163KB

  • MD5

    5b83e0964251410fa730051e3c5fdda0

  • SHA1

    4cdc2a561af74bfcd1bad18f7cd7fc399afad467

  • SHA256

    ddb2653400d36e32157171911b98bde74cffec64b6029172bea2bb5c94363cbf

  • SHA512

    5a1b0ba2125543dd12b31859660be9321e54c29e886968b96c0e50daf791d67b7533045bb5c29ba97b066a7bc49eb77e11c46c89c4e06da21508952ce2e25b38

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmSXrw3Mtr0srI798Qr:RqlIyFESWu0SWu2sG98Qr

Score
9/10

Malware Config

Signatures

  • Renames multiple (422) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.5b83e0964251410fa730051e3c5fdda0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5b83e0964251410fa730051e3c5fdda0.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3125601242-331447593-1512828465-1000\desktop.ini.tmp

    Filesize

    163KB

    MD5

    37e54fe36a56452e274b418f656a1000

    SHA1

    70e5085be96bef64d061186687e1f7e90c7cabe5

    SHA256

    203ca86ce8bc02c2146943c82243bd99003d727f42ebfd1b7184280d020dc006

    SHA512

    bf1324f0f2b81aa05c4113dd5387f647b2ad17df494692baf92baca167d889c265fd096a3619b5366c28831834b8f122c70fff48eac33154fad24f3bc604aec0

  • C:\odt\config.xml.tmp

    Filesize

    164KB

    MD5

    b56be9d7f62a6d95ba83b6f96f236a23

    SHA1

    9d938ea25dc4b32d4d2a34eaa57610d0dae8bd94

    SHA256

    77cb4d30cbca3353273afbd48ba7eaa2acea631c296d7eddd145f6d33fadef25

    SHA512

    af7d4edb881e5bcf76d3b4bff027fab1782d0d32efed7f1d1263c5b1a033072e9b32b837c1d229559648d3fac1a738f4419bcbcab640d0e33fb002c65f0dd66e