Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    14/11/2023, 09:50

General

  • Target

    NEAS.2659ae08a968a2b0ac9a3f37f7d15f32.exe

  • Size

    186KB

  • MD5

    2659ae08a968a2b0ac9a3f37f7d15f32

  • SHA1

    568317ba4e300a4f19719455219776441ce513e5

  • SHA256

    eb615305f8e81e6c98af513706f3cc6ee6e2b17221706dbafe26804135261719

  • SHA512

    fa23217b23911c8b476982e03fc6c6e5ab899417f6a64f48a9034687ab33d0b14b4dcf507056e07e521fda5710a25777dec700f2a55bcc1d22238aa599434fbf

  • SSDEEP

    3072:6e7WpbAIuZAIuYSMjoqtMHfhfpYRY0Zk6z1:RqBAIuZAIuDMVtM/8as

Score
9/10

Malware Config

Signatures

  • Renames multiple (1079) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2659ae08a968a2b0ac9a3f37f7d15f32.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2659ae08a968a2b0ac9a3f37f7d15f32.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1154728922-3261336865-3456416385-1000\desktop.ini.tmp

    Filesize

    187KB

    MD5

    10f0a5c20670f1dd35250d8591003fa4

    SHA1

    9acc8c7d6a61bd71489604ebc6ad40be654b2f15

    SHA256

    95533f654b0463b8ad43fefbe4f83feab3d1b5377e47c25ca378b4248c81c6d5

    SHA512

    16b11c44050dc97fa797b7f170c39030479400928f705786faca9b492d25b65b2744a364588eba5930a78f3c76de2c82ea9e8599ffebf85016ef7b1266ca3853

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    195KB

    MD5

    801e182476bf72fb310b6da483f159bd

    SHA1

    5c1b37242159a3e720e149734d32eed2b94eda8c

    SHA256

    c71433cf7718cd11dae69112d550a7d732664eafcf4e63719a2852ac2105c5b5

    SHA512

    25d3826ca180a185bf6ebba393d69ba3f23e6d8c91de76b6136b6ecfbf4b020db26737970a164e76ad9298c9662e8ff40a7f93ab59c0db4864b7783b20561344