Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 14:02

General

  • Target

    NEAS.155d759c9e24bd4a7ef436eefa23899f.exe

  • Size

    91KB

  • MD5

    155d759c9e24bd4a7ef436eefa23899f

  • SHA1

    e9f41544b24ad712898581e5072a931bc8ebd9b2

  • SHA256

    695a7015bfc188ad45f2f5774e040b40ead48581663b036598672aac30cdd866

  • SHA512

    794c4162c1e7f6bec2feb71ac63eb78d71cb8eb2877699c7fe0513fc054b1a121e052a6b7b44e86db035142b4b236ee1e09ad1af0d582f8874d75c5bb241033c

  • SSDEEP

    1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggA3X4lhkbwdGlgGlGAq:6e7WpHIyRF9ESWu0SWuDmSXrwQlZl6

Score
9/10

Malware Config

Signatures

  • Renames multiple (541) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.155d759c9e24bd4a7ef436eefa23899f.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.155d759c9e24bd4a7ef436eefa23899f.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3811856890-180006922-3689258494-1000\desktop.ini.tmp

    Filesize

    91KB

    MD5

    e4dda49f57f416b5d7a37875fde6e3bc

    SHA1

    1851b4c07074e4483965328d3d48d2d892294347

    SHA256

    6f25bd57f34c4087ccb9984269987bf0a6e895d4ec4df90a852b0df0e6dde105

    SHA512

    f3bd2ccba5b6c33d9f8aff17d7a69e17c3cdcaef812f1d2737471805d03f69bf08ce43ba871d00b8d61f35d65bb1c3ff9f7e0e4226f1131a894d7ea1ff561b12

  • C:\odt\config.xml.tmp

    Filesize

    93KB

    MD5

    2925f96f2762fa06d0d0d843c9eb1eac

    SHA1

    22d1b38061e13cd846981f6b1fcdd87360d88147

    SHA256

    0f9c8b866289208ed2a4b60f7716eb5c2ed9f5180fbaf5426267a7f88d18db7b

    SHA512

    83b1f9319fc0386b04d21e5ee9f1c8d7152bcf33e892ba7133cff22ed6b57ce293911b7a411873230e6a259b422d80363417b2fc82120b4db88e3330392b9223