Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 06:14

General

  • Target

    7e5cc84731793a5652b28bf0fc7e3e70_NEAS.exe

  • Size

    88KB

  • MD5

    7e5cc84731793a5652b28bf0fc7e3e70

  • SHA1

    a5f4cb23a375af256b4db5a4c7d17e2c3545bd50

  • SHA256

    fc5677f1e2c9ab0cf449196b88dd0cc35529990a896ba3cedc7f1cd8652fe788

  • SHA512

    ad5b4e6c3c2c330d886a49695646689f9dc761934aa0cc7c5d60ad2b0beeffa31d7605b19d8b45f9705058ba28c355458d4700369a71b97226fc8688c172f4da

  • SSDEEP

    1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNJ8/8W:6rWpcOPxPke+e3fFpsJOfFpsJbgEEkW

Score
9/10

Malware Config

Signatures

  • Renames multiple (5019) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e5cc84731793a5652b28bf0fc7e3e70_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\7e5cc84731793a5652b28bf0fc7e3e70_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2860750803-256193626-1801997576-1000\desktop.ini.tmp

    Filesize

    89KB

    MD5

    bc4c167f2c2c2dc235d3e439cb687dc6

    SHA1

    287bb934450024f375e48f6be7e7b6af92ccd8ee

    SHA256

    5fdc1ec2d0110eefcc76475e14232f440114d6b6552b11711f907d5133a58e88

    SHA512

    428dc3c640960ef979972c84fe2c5a7d4da6e9326a4850d3179579b129dec5616be7415c413878ab8da7c35ac1244fc9dd553968f596b9104fd888b71b7fd4c5

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    187KB

    MD5

    b2b3dfda43656e9c69d27970801c1349

    SHA1

    a97564b90743ab646c6ab5c92567b49b7d82ef67

    SHA256

    a6c5844da09f0d24f692ec0b0ceae4bc71a69c6e4f43bfb2d5260a45346e403f

    SHA512

    b225028c32611d675e4518e08e6fd8c85067d00d19194f9eb4c6c1dbef401f88fc8e10c71e88c9dc5b4802e462b8c8dcb17e0c1e498d9a8ebf7bb9573e4e4f66