Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2023, 02:47

General

  • Target

    NEAS.6fd7767cd2561aa734c47c7e1bc3b2d0.exe

  • Size

    100KB

  • MD5

    6fd7767cd2561aa734c47c7e1bc3b2d0

  • SHA1

    372788dc71b1f0b17221b894dd8bc03f0aed3289

  • SHA256

    b9a484da7117e6630703560962e0b1a549736848a6cc9ffbdf10d6b51d60124f

  • SHA512

    d08ee81e011163db4508b35d9cd232c4978fcb71cad171078ca0e601d642f41cad4949bf57774f9a10581bd6ab738cf2b710ac259c6224bc4d920836a25c0d5d

  • SSDEEP

    1536:W7ZhA7pApvOsOKe7ZhA7pApvOsOKRlJOblJOVQP:6e7Wpse7WpXQP

Score
9/10

Malware Config

Signatures

  • Renames multiple (965) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.6fd7767cd2561aa734c47c7e1bc3b2d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6fd7767cd2561aa734c47c7e1bc3b2d0.exe"
    1⤵
    • Drops file in Program Files directory
    PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3125601242-331447593-1512828465-1000\desktop.ini.tmp

    Filesize

    100KB

    MD5

    51f0e83a4d016251e7d80248d04bdaea

    SHA1

    bf27da606a0aae40d22147d9d3d97b66496946bd

    SHA256

    24441d6c193cc301faf110ce83719dfd5d4df3bf2e804cfdc4a9e263a3c4ac2f

    SHA512

    8cb909f97c1d41518ec70b1aa4ba9c176bce6020ee1fdcadeaf50f57761a7791b43ed8f0848a3a68ee98651b8e256026a0e6e7f5e07229508ee70d37f256f650

  • C:\odt\config.xml.tmp

    Filesize

    101KB

    MD5

    cb34feca4d288ed4c1b5911d4cc7a8f3

    SHA1

    4a5788697e98aadbc8bc8dfa2b75ef7f2c152142

    SHA256

    616c1b659dde312e49aded6aec68fe5250ba1dc76d53d4d635dcd542c12c056e

    SHA512

    f0b16436afc066cfe6ecbb64d000acf41aeca4782eb5cb4820d4cb787525e4bd255392b47450762e648774d5dedab2d09e629f7469b641475b1c10d104b729cf