Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16/11/2023, 11:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe
-
Size
49KB
-
MD5
1266ce372e8274d4f06d1d1c442d1ea0
-
SHA1
99d4d1fc1451016b9180086a0b4a3e6a600aca05
-
SHA256
ed63e8cd7ddccaad5627646c1fc9ee2eb8af4afa6d44cb464d2b4a9eebd4b6c5
-
SHA512
e6935ab23e8e96645ec98b2d85cdfbf7a524d794ff7a352ceb6c214b1cbf4fdde8b4004e335aa408c8e20d8befab4bd54441d69ea9a2d019e660893778628ccb
-
SSDEEP
768:W7BlphA7pARFbhOm0CAbLgt7BlphA7pARFbh6SCtjR4PQR4PK:W7ZhA7pApH1t7ZhA7pAp6SCtB
Score
9/10
Malware Config
Signatures
-
Renames multiple (328) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Internet Explorer\F12Tools.dll.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\7-Zip\7z.exe.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp NEAS.1266ce372e8274d4f06d1d1c442d1ea0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD513279563b9f735b7bad3ad12a7df5ae8
SHA1023fe363266d020a41fe9c355bbb18cc01b97273
SHA2561372dca38db42ba51b9f0c1942ab2109d9fa2a3efb09bf25b0629730bf3a4fbe
SHA512c75ff890601e495c588b3c6717d3ddf2619b4fde6c467c4d6cddb930172e3f5f8ce13fab886e7d0dad49c20d2f9e5bf3f985b9f3ee9fb91860a66ac7a1b2a839
-
Filesize
58KB
MD5dae809cf80cea8bd3884b0f2bc1476a5
SHA11abe1c63db74a0102b85572f1b573088a890de46
SHA2566b20eafc272c63c04757dc3ff59569e9cdd54c1666af00794d7ce04c625bd056
SHA5129abadb70f405a3599505014553a9c4162545551d920cd5cfacbe6cd04c522dd356bb7c66065ad4f05c77f7e11cd63c9061bfaf9367157aa3829ad45a45c492a4