Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 06:35

General

  • Target

    83d5146c62ade838c923bbf9f842ce10_NEAS.exe

  • Size

    78KB

  • MD5

    83d5146c62ade838c923bbf9f842ce10

  • SHA1

    e5effaeb5a9127af9cd13608adb035bd9383ce88

  • SHA256

    66ccf566aa1f1245950c1d584225cb81c27a97b95e87b35c884905deb7716e4f

  • SHA512

    de0f98b5e16e8070189a646bd3c86d092c4ca72407347712bfffc0b40852533defba6f600093beb250dcafb64ff94832023d97d020eea795e5e3e8180bf8ef80

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YWtMQQQuMB:6e7WpMaxeb0CYJ97lEYNR7ZtN

Score
9/10

Malware Config

Signatures

  • Renames multiple (3512) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83d5146c62ade838c923bbf9f842ce10_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\83d5146c62ade838c923bbf9f842ce10_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    79KB

    MD5

    f4c567dfe7a94af53d109a7158532996

    SHA1

    52663137cb0b38b78ed346266ed04307b80f905c

    SHA256

    37f877c8625628bada4d497863fb19076f5cccba09b83ff58f13d23df0f0b5e4

    SHA512

    33969bf703371152407d9b627976761a5d30f8d88774859a2ca655641c47fced062ad74b4ec30ac903d07f303aa4627641ccb9a974797b0e36a30d94b84dcb2d

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    88KB

    MD5

    9ff36bcd63278a473b51321589c27e84

    SHA1

    8d71742ae0aab164aa7695244ce1eae0b1aef05c

    SHA256

    be66dedd38d5f9eaa27b217e3a1f708000b63447830737cb517833169aeec0ad

    SHA512

    82092f8a3d0fcadcbf7efa90a76168a806c29782d8e3410041ff8f6e2244630889b56a1c2a9775738ca1adef91a1f6b1aa95c0199197abcd9d97c109732e4f03