Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
15/11/2023, 08:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.dc686a074b476afc09806538bd8185d0.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.dc686a074b476afc09806538bd8185d0.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.dc686a074b476afc09806538bd8185d0.exe
-
Size
182KB
-
MD5
dc686a074b476afc09806538bd8185d0
-
SHA1
58c47ce890991d9bad9211cb6815c1153875cfa5
-
SHA256
423732eabc4ebbd4a04d7f487b654cb4815a4ce0c1872be27fa13a2484c4ffd6
-
SHA512
c647ea83b51c07d019fa3946df48585ff382cd30fb1036ab291f76dc5710c1004f794b28cccbe96379f3c61cffa57f9bb4f519382cb34050d4f14c88868ef1d8
-
SSDEEP
3072:6e7WpbAIuZAIuYSMjoqtMHfhfpYRY0Zk6zS:RqBAIuZAIuDMVtM/8a/
Score
9/10
Malware Config
Signatures
-
Renames multiple (567) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\nb.txt.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Internet Explorer\F12.dll.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp NEAS.dc686a074b476afc09806538bd8185d0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182KB
MD5171608f972e0ed36493cd28e81a999fa
SHA1007a869c7cbf44c0e68e94fd057f69eb4694730f
SHA25607f6733658409f5f23ef959e895a7e8e950037f617b3eac9a401a861abcaf6de
SHA5129541f19254221cc5031c496c5ef7ca622cc991dc46ec4da244af562f77d1c5f67a2fef628f91a21f88e99c59b6903422bd24aeb7d9c0ef9df92ca2df4ffc48cc
-
Filesize
191KB
MD583dc3a8fa31f45ea4c0b90978b6babe6
SHA13abdd4ef71bb39ae374373c09bf8e5acc1364750
SHA2562472659a272e954da7ec13ca4518f6a549c81206aae61bdf219c4ddff9782a15
SHA5126f52210614567b57e010f85d689abd4c55c0ce373dab196e1b5f5abd6d300142f7d46eeda9c496db4969ccacbf25282eb196a4fb4e324917d206871de36fbb22