Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
16/11/2023, 17:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.56a86c4262ccc6da169aa85e665fec38.exe
Resource
win7-20231025-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.56a86c4262ccc6da169aa85e665fec38.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.56a86c4262ccc6da169aa85e665fec38.exe
-
Size
206KB
-
MD5
56a86c4262ccc6da169aa85e665fec38
-
SHA1
5301f194c6f7afc6b29b05ee072678fd8f153d3d
-
SHA256
ad3b432982f9f8e15602695e32ef7d4ba5d97d84c84f48cbd95cf018692ad121
-
SHA512
7a7d9d9d3f138b5018c02555ad95d919eeeb635cb5c57bae37d1ea4cc98d5d437395a47d0acffac6b9e27a0a886ddd820dfa57265a002f97776f064a36d52c9b
-
SSDEEP
768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qswPNPQP1zAP1zA:W7ZhA7pApaX0aX0wPNPQPOPK
Score
9/10
Malware Config
Signatures
-
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\DirectDB.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp NEAS.56a86c4262ccc6da169aa85e665fec38.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD5a4f83993c366281296801bca0b82ef88
SHA1c3b953e37dc1db3bdf45c7452b22779989387cc6
SHA256d7e8b039a78c4f45075763bc18bc45e774ff10d5c71ad2d695799c2608ba8605
SHA51244f379f2bef981cb0d25f9dcdacb803a8fec2a56116f5459c403de46ffd8142005010a23ac570201ceb67e2d6decf56eaede45d00f998de86b6933e62644eccc
-
Filesize
216KB
MD5d63a40c3686cdbef01c50185411b8d29
SHA14d0ad2664097f4c7b828e4b78d78544b94e5d8bc
SHA256d1c33e0621092bfde96e1e7c990c55cd96674d159d61d3975a91fc1b6ab46425
SHA512dbeac0d0a02f710b278c3e129dd8fb61863fe8ecaf0201c68bd8253a8c923f79d6dd29e861faf6e955b256315197374fa6dd014d2b86c664d315e5857c1fa521