Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
8c3811ce570048160575493a85be6280_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8c3811ce570048160575493a85be6280_NEAS.exe
Resource
win10v2004-20240226-en
General
-
Target
8c3811ce570048160575493a85be6280_NEAS.exe
-
Size
65KB
-
MD5
8c3811ce570048160575493a85be6280
-
SHA1
cf3f831f06543e631722e7ce13adfc51e54394da
-
SHA256
cc169426dcdb80402bc8e78b76a6d46ce993a6da84e6ec23e19f16ea91a85762
-
SHA512
9c2b48e7f67b7189a0614293db060af646039fb2cae79627d437cb38c5d8207a95aac35dd37e7630d893d3c46bc593ef0ae240c27403a3456b8678af9fcf5cbc
-
SSDEEP
768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxt0YRYvBh:W7ZDpApYbWjIlE77ufL6YRYvBh
Malware Config
Signatures
-
Renames multiple (1375) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-private-l1-1-0.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\WindowsFormsIntegration.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationFramework.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationFramework.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Native.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\PresentationFramework.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationUI.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.TypeConverter.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\vcruntime140_cor3.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\PresentationCore.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.Annotations.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.Lightweight.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsFormsIntegration.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Controls.Ribbon.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Printing.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\UIAutomationTypes.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Parallel.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationUI.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Xaml.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Xaml.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Design.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Input.Manipulations.resources.dll.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\7-Zip\License.txt.tmp 8c3811ce570048160575493a85be6280_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 8c3811ce570048160575493a85be6280_NEAS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c3811ce570048160575493a85be6280_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\8c3811ce570048160575493a85be6280_NEAS.exe"1⤵
- Drops file in Program Files directory
PID:4140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:3512
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5523033a479e8c7e767418e99b8ae7652
SHA14fc2adfa12675dbc07f46e08b2ff2c70393a6455
SHA2565274afc8b78356988afedf36ee33ba388e1534a518a9ed6abe04ebc0e202fb18
SHA512b32596022b38f471d5996e079b94190229e738690fb33cc85abbeca466345d5a36cae6ca2415ed374e38ecaa4c492f9678beef229e367a515b4030ec132c5033
-
Filesize
65KB
MD518332f0b7335d7b21100e3ce95a853b5
SHA1a1f13ca956e3da1083fc23f100941b9ccd0e8405
SHA2569e5f950e54567b0778f1eb66a81682e08f3b20d2d2be5be1695662539b2c77fb
SHA5122fe11ff0ed4c7e82e502876efcc65f9aca5bcd7c51d962f4c8c2b51be26adea5ee503c0e2279d4b002a354e7fa7251d5937e374cabc30203e575594f7bfbad09