Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2023, 17:25

General

  • Target

    NEAS.56a86c4262ccc6da169aa85e665fec38.exe

  • Size

    206KB

  • MD5

    56a86c4262ccc6da169aa85e665fec38

  • SHA1

    5301f194c6f7afc6b29b05ee072678fd8f153d3d

  • SHA256

    ad3b432982f9f8e15602695e32ef7d4ba5d97d84c84f48cbd95cf018692ad121

  • SHA512

    7a7d9d9d3f138b5018c02555ad95d919eeeb635cb5c57bae37d1ea4cc98d5d437395a47d0acffac6b9e27a0a886ddd820dfa57265a002f97776f064a36d52c9b

  • SSDEEP

    768:W7BlphA7pARFbhKKVeIuKVeIaCgx+qsaCgx+qswPNPQP1zAP1zA:W7ZhA7pApaX0aX0wPNPQPOPK

Score
9/10

Malware Config

Signatures

  • Renames multiple (860) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.56a86c4262ccc6da169aa85e665fec38.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.56a86c4262ccc6da169aa85e665fec38.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3125601242-331447593-1512828465-1000\desktop.ini.tmp

    Filesize

    207KB

    MD5

    904d79e3bd0d9cdd02436370c2813d81

    SHA1

    5bbd0941abc3d98a385e01cb682db3b7215b67dd

    SHA256

    ecbe30ea8c7757fadef5ffaa098e1be1f00a12d7df34ad29804c097a6685cef3

    SHA512

    576037d25e98899156e036c8e2239a2895ab06f66dd1e51a537428d49b3dfd0101b9250182f7ab815504eeff218c8ca4b9b95a6508509327367e6b9404877686

  • C:\odt\config.xml.tmp

    Filesize

    208KB

    MD5

    2438085869311632f10cc8d7c4fa38d7

    SHA1

    d4781602221ce47f178893e6cc551c6e356737b6

    SHA256

    a67455860a64b5c40ba406c7b5e58a9be76694b20a320674fb24d5b962e856a3

    SHA512

    52010daf5a33f8d37e5328d90794818bf2302cc6ec4f9c7d5da1a084b3825bde2388a44c7374b31eb41f1c7b03c6022bc9f728f2917d1e7cfe80d7f29be33ad5