Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 04:21

General

  • Target

    65196064e978174aedfcc1913e75e530_NEAS.exe

  • Size

    116KB

  • MD5

    65196064e978174aedfcc1913e75e530

  • SHA1

    1e12aae816d32d3ac3a03cf234c5121ad7c26495

  • SHA256

    02c9807cc916eee30fc839a2c0a9f1d1bab23a82a67e7779538ee61144fe6909

  • SHA512

    526fdd56d79c73b9195190e480f73c711a2eb869a6b54092f5c376661c380d6c4da0eabf74e41d0f9c73568ea28689aaa2729fb2d679b6316a892e1c756642a8

  • SSDEEP

    3072:6rWpcOPxPke+e3fFpsJOfFpsJbgE2GEJdwJdXgX37:tFPxPke+eI2GRgX37

Score
9/10

Malware Config

Signatures

  • Renames multiple (519) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65196064e978174aedfcc1913e75e530_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\65196064e978174aedfcc1913e75e530_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

    Filesize

    116KB

    MD5

    a308bd8f240de6d9708aad6ac010811e

    SHA1

    a7de60eed11a7ec85750b546532e003289426aa0

    SHA256

    366f370d4c53ea44eaf3f16e76c410106c89faee823989152b55b56fcfa29bb1

    SHA512

    4f607bb9212e0256c5c80078d6f6cf2bf23d1d4742df2f9371221430c12ea5a464e4d27c84992506add158351d8f868a2a3b44fa1e49867e624afac6f0b523c7

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    125KB

    MD5

    15e131b250101a5cdee0ae48aa27182e

    SHA1

    98f6dd4a4d4e6fcb1cdbd7f0f345bbaea6352ba5

    SHA256

    8795acab20832e8a300f3782f4ee7b89d0d0208799a412d231034bc4ba236f59

    SHA512

    cb4fcc15c969422ed639b0e8c0976dd1347ee2e2413c83d55ff5daa21e95476aa12f630eeb3151bed3860a8c8f000c604b8d621f25a4f70299f6e6d017957f6c