Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    175s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 13:53

General

  • Target

    NEAS.116f1846d2fb3b8a7d05ca4bfbf4dba0.exe

  • Size

    116KB

  • MD5

    116f1846d2fb3b8a7d05ca4bfbf4dba0

  • SHA1

    626170d4ca1020e71b413a59c77c3ebba5d73648

  • SHA256

    34b7160b61ae6d5c45f6e6efc93c0b13da0131340803009469122b5211c6b906

  • SHA512

    88de540b9382e37b876186079266c016ac263767e6ae3fedd0a8585228ea069bd402811e0d2a38401b1c2a0258e3a0aaae59d407cb4ac960f646a802d7344aa7

  • SSDEEP

    3072:6e7Wpcm4HISSP4jgbEl4TWZFU6TcTSWEmOTcTSWEm33X:Rqe6CgbEWToZo3X

Score
9/10

Malware Config

Signatures

  • Renames multiple (330) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.116f1846d2fb3b8a7d05ca4bfbf4dba0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.116f1846d2fb3b8a7d05ca4bfbf4dba0.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3125601242-331447593-1512828465-1000\desktop.ini.tmp

    Filesize

    116KB

    MD5

    8f718eb79dee0b43932f6e34e8a6daa8

    SHA1

    f66b5aaec9540dd23d21f4f276839aed39c91b9b

    SHA256

    cd9e2948a3520b95e28ab756f5f9733ae0d9b545fc001ffa450abb06148db499

    SHA512

    ca1ba8207071abce8ddc551c5e07a153fbade6e0aa4352858fe2440f59c87113afd096c57d89fb289a57ecc5559d31bcac2c0cb76446955c26be5f4444534c58

  • C:\odt\config.xml.tmp

    Filesize

    117KB

    MD5

    af6aac5e53a5c88bc0adb0a9be2a0b5e

    SHA1

    2fed81d867b6ee75c8c54b3a88abb4ecb171f4c6

    SHA256

    421d42a6bb9c84ba90c313e57cb0e9e92bf059508561d1210939b0a1c1da40d4

    SHA512

    c08944f2b3f4a239fcf8da207e6fa3ca9a1c9905c954e99f527ce123ed6573c4d2757e7508690114ce4038e56f7197c8f1d3cd1f6d93fb043da9f27353048dd1