Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 04:04

General

  • Target

    61fed1c6d28b5f76bd832e0c6e8e5f40_NEAS.exe

  • Size

    313KB

  • MD5

    61fed1c6d28b5f76bd832e0c6e8e5f40

  • SHA1

    5f030c5c0de31e500ba2c66bfdb157c0fbd928eb

  • SHA256

    5c811b33dcbf0e17d4180d63fabb6ba084c0ddaca666ae470cab98761ad92393

  • SHA512

    7de5e881b2980569be05f53bf13444ae1e34bc610613f4d64bf392197a00910132eba844949d7e52f7e20b4e60762cb5bd808f0287c035a065d40846c944a09a

  • SSDEEP

    6144:JiQSo1EZGtKgZGtK/CAIuZAIuExQSo1EZGtKgZGtK/CAIuZAIuZ:AQtyZGtKgZGtK/CAIuZAIuExQtyZGtKF

Score
9/10

Malware Config

Signatures

  • Renames multiple (2850) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61fed1c6d28b5f76bd832e0c6e8e5f40_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\61fed1c6d28b5f76bd832e0c6e8e5f40_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    313KB

    MD5

    408c2e64ac5696367f94469b83015718

    SHA1

    37600d2134395372e5a7ff79467aa0eae1b696ae

    SHA256

    3fa9aa220f4d7e8bc0123a0c046298e6806142e6c4a702e53cb2146d202eb2de

    SHA512

    d4adabc1c1b33d624ad911691810f2b775b2c8bd0fb248b6274f7d8abced9e1c830263c05f9126caf499ec10211a462ce653b27047c7b4b4a3e6cd761ace2eb5

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    322KB

    MD5

    f25645ad16bcf0f25e522f9312f6f22f

    SHA1

    ec194d4dcbe469c81a9889df8cc77febb25f64e6

    SHA256

    97ea2cd84a7e2b018c25c687e76625e530c4690b744665f869f78de4d45ea084

    SHA512

    a3db3d68577956f2873410c94596f64a5fed7047f950e4bd5d746c18d2549de5894dfe36e6a74a8a071f4407cb3c53ed8c64b6a32adbe596486fce9673361aa3

  • memory/2204-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2204-472-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB