Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 13:36

General

  • Target

    a547203ac8200f46713087142a04a620_NEAS.exe

  • Size

    122KB

  • MD5

    a547203ac8200f46713087142a04a620

  • SHA1

    dadfb5b4abc4a908758dd4441c27a25a4273c58b

  • SHA256

    ff93a1971a22dd7523e9ef76fd07ab12a78909d7359b3569b13b53449ff017cd

  • SHA512

    9c044d4e70febc4f7d14f64ae68fc7d74263ae110aacbe49703dfd414c2399804a1e7f14898573d8e8758244041f08ac9f0f0eba65b39cc6c40c3b722967bed7

  • SSDEEP

    1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCa:+nymCAIuZAIuYSMjoqtMHfhf5SC

Score
9/10

Malware Config

Signatures

  • Renames multiple (3451) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a547203ac8200f46713087142a04a620_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\a547203ac8200f46713087142a04a620_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    123KB

    MD5

    4aa5430ba75f688103769d4ac0d57455

    SHA1

    e70403e028a4b6bf199add167f5d2e4f4a8baa54

    SHA256

    97ab52f46d82f1de82ac1a1ac34eba465e8c0f2ed52905c18a843726e3c21c75

    SHA512

    b22d4d8d99ac13f3f90ec904245327bdc82c12e8c7eedc81320f175121c6d16f4ca04de0649cfd709ecb284b346d4424e1125e27d7cfc24d2d6dd87ba9992f58

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    132KB

    MD5

    a6e6fc99393c3fab03cf36cd8f9961d8

    SHA1

    b2316d29d9a3baf63183f7f0a7357b531d822e3d

    SHA256

    5f6498c53337b44e43e6fdd4adf9bbf3acca4d877079d8d2b66c785e12d573db

    SHA512

    95da04ec712183ce5c9ec3767ac6362a2960aecf95295cc5d5ff5616704e763858448771bddb9b567ce8bf98d28333db9ff250a750dbf39923038defa3b8e7dc

  • memory/2868-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2868-632-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB