Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2023, 09:50

General

  • Target

    NEAS.2659ae08a968a2b0ac9a3f37f7d15f32.exe

  • Size

    186KB

  • MD5

    2659ae08a968a2b0ac9a3f37f7d15f32

  • SHA1

    568317ba4e300a4f19719455219776441ce513e5

  • SHA256

    eb615305f8e81e6c98af513706f3cc6ee6e2b17221706dbafe26804135261719

  • SHA512

    fa23217b23911c8b476982e03fc6c6e5ab899417f6a64f48a9034687ab33d0b14b4dcf507056e07e521fda5710a25777dec700f2a55bcc1d22238aa599434fbf

  • SSDEEP

    3072:6e7WpbAIuZAIuYSMjoqtMHfhfpYRY0Zk6z1:RqBAIuZAIuDMVtM/8as

Score
9/10

Malware Config

Signatures

  • Renames multiple (2602) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.2659ae08a968a2b0ac9a3f37f7d15f32.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2659ae08a968a2b0ac9a3f37f7d15f32.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1114462139-3090196418-29517368-1000\desktop.ini.tmp

    Filesize

    187KB

    MD5

    50a40944d347f44c0e5ad06526ac93d0

    SHA1

    8140e126ccc646b6e53d57cd306daf27f2f9df6f

    SHA256

    b042ebd10b5effb3db8b9f4f0e359755811f44fbad4f34e8b401638ecc770e29

    SHA512

    fdf4237d5c517b6f64142f5cca1441be4624fa61aa507d5d2b3a95e8cd556e9f93ec405b6828e1e3232f0968c4b0cd7d36a7f60b6786a6a232a3933b25ecf034

  • C:\odt\config.xml.tmp

    Filesize

    188KB

    MD5

    693f1cbdcc2c1f32fd3d1167860929cd

    SHA1

    6a3949fd5bd099133442d1641c65db904f698809

    SHA256

    f57390e408a479f92680e22cbc4905a6ee41ccab91cb1949b90be9e62217f7d8

    SHA512

    1c5e5cfb2b359b1ee0143c57df865166469ae416dafd098387de6b7154c833777ef0c215d0371fd4bd09139eb6a18d1cdef8684d56351690980244ad57ade3b1