Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 06:14 UTC

General

  • Target

    7e5cc84731793a5652b28bf0fc7e3e70_NEAS.exe

  • Size

    88KB

  • MD5

    7e5cc84731793a5652b28bf0fc7e3e70

  • SHA1

    a5f4cb23a375af256b4db5a4c7d17e2c3545bd50

  • SHA256

    fc5677f1e2c9ab0cf449196b88dd0cc35529990a896ba3cedc7f1cd8652fe788

  • SHA512

    ad5b4e6c3c2c330d886a49695646689f9dc761934aa0cc7c5d60ad2b0beeffa31d7605b19d8b45f9705058ba28c355458d4700369a71b97226fc8688c172f4da

  • SSDEEP

    1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNJ8/8W:6rWpcOPxPke+e3fFpsJOfFpsJbgEEkW

Score
9/10

Malware Config

Signatures

  • Renames multiple (3490) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e5cc84731793a5652b28bf0fc7e3e70_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\7e5cc84731793a5652b28bf0fc7e3e70_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

    Filesize

    89KB

    MD5

    973d2b7b7bcb8742bda5a78418094814

    SHA1

    88c98e27703a462a5aeaa3d91fe7e706b1503979

    SHA256

    710703c3e364d62cfb1b438426ceef0f83bce1b66f693eab9c1bda3bae5c207e

    SHA512

    799d1d4c30826f19980f32e7cd90176240e0ece92adadfcf48c0bbd8db0f1bcbbae20e853fb9f3f311968ed7ddec413ec8b360c9a93d6598792d2ad01528df53

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    97KB

    MD5

    fd8293ea7a9c567ec04c2a8418ea5fb8

    SHA1

    e031412bc16f7ae656ce08be07012d78c9d6a8e6

    SHA256

    0d2bb16c1a1a763f2b7a22890c0e77a8c2ea4bb34b14cc59e4521543337412db

    SHA512

    20b6a36049eb171c355915fd7dab8a283130eabc41a12c1d35894392197a575a9cc7591d20129c0e362880b6702c016014bbb04666eb29c50a1159233ad77253

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.