Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.5b83e0964251410fa730051e3c5fdda0.exe
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.5b83e0964251410fa730051e3c5fdda0.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.5b83e0964251410fa730051e3c5fdda0.exe
-
Size
163KB
-
MD5
5b83e0964251410fa730051e3c5fdda0
-
SHA1
4cdc2a561af74bfcd1bad18f7cd7fc399afad467
-
SHA256
ddb2653400d36e32157171911b98bde74cffec64b6029172bea2bb5c94363cbf
-
SHA512
5a1b0ba2125543dd12b31859660be9321e54c29e886968b96c0e50daf791d67b7533045bb5c29ba97b066a7bc49eb77e11c46c89c4e06da21508952ce2e25b38
-
SSDEEP
3072:6e7WpHIyRF9ESWu0SWuDmSXrw3Mtr0srI798Qr:RqlIyFESWu0SWu2sG98Qr
Score
9/10
Malware Config
Signatures
-
Renames multiple (422) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\ConvertFromAdd.pps.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp NEAS.5b83e0964251410fa730051e3c5fdda0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD537e54fe36a56452e274b418f656a1000
SHA170e5085be96bef64d061186687e1f7e90c7cabe5
SHA256203ca86ce8bc02c2146943c82243bd99003d727f42ebfd1b7184280d020dc006
SHA512bf1324f0f2b81aa05c4113dd5387f647b2ad17df494692baf92baca167d889c265fd096a3619b5366c28831834b8f122c70fff48eac33154fad24f3bc604aec0
-
Filesize
164KB
MD5b56be9d7f62a6d95ba83b6f96f236a23
SHA19d938ea25dc4b32d4d2a34eaa57610d0dae8bd94
SHA25677cb4d30cbca3353273afbd48ba7eaa2acea631c296d7eddd145f6d33fadef25
SHA512af7d4edb881e5bcf76d3b4bff027fab1782d0d32efed7f1d1263c5b1a033072e9b32b837c1d229559648d3fac1a738f4419bcbcab640d0e33fb002c65f0dd66e