Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.691ed61516a181536e292dabbcc002f0.exe
Resource
win7-20231023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.691ed61516a181536e292dabbcc002f0.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.691ed61516a181536e292dabbcc002f0.exe
-
Size
93KB
-
MD5
691ed61516a181536e292dabbcc002f0
-
SHA1
6467a9a315be4386913c638a373b99a58a2b0c4f
-
SHA256
b526d8417be6d09d2b65b105363b7ae947485b2ab64b273f20a0a7f6e7c755ad
-
SHA512
a409a7ae4e3e4f116a69a086d6969a8c4ab62dfbd2ea75231f3c9d3219177d0ac6600f201e3ed6d630c30ea997d2e38b6b87c4e368cbdd3755b2216d5529fea8
-
SSDEEP
1536:W7ZhA7pApvOsOKe7ZhA7pApvOsOKJBKEqhKEqz:6e7Wpse7WpBDqhDqz
Score
9/10
Malware Config
Signatures
-
Renames multiple (215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\br.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\License.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\descript.ion.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp NEAS.691ed61516a181536e292dabbcc002f0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5d06feb9797900d4e51be63910dec9144
SHA170f404462e45789006e331ca9d9f7f002add0d76
SHA256d357ed823541d49fc088328cf9eac02bdac9f286598bb6bccd7b39ce4d025e1a
SHA5128204ef7eaa9a018e9d5ff6ad9ca7563769f42c258045b6ec4fe49c80da54e0c270e47987a9e52126899c98a6b2aa472738ce5499ac102aeae7c81daa06ba8270
-
Filesize
94KB
MD595a3cb07f3eadc9be5e7b6f524e95c8a
SHA1a107ee87dd7616ca7c585d51efe3eb2459a6addd
SHA256bb8af57236ea74dcd14fa8a9cda95919eea4dbd1ae7bcebf6a5351d9a01967f5
SHA512750b8b57b2cfc3a14e033c0689eeeb1d2a1956a8586c8c5ab2c7a7c6781d1212753afe66bc0f6dd430e76ed4915d4c2fb32dafe5341fa7fb8a880fa10f52d317