Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 18:15

General

  • Target

    aef8414f1422fa21b0209def99e5db66_NEAS.exe

  • Size

    378KB

  • MD5

    aef8414f1422fa21b0209def99e5db66

  • SHA1

    23a61b0ebdbf9492523879e09d5f894ac34e92d9

  • SHA256

    2d73a1fa8b61c47e53cf471899bdcf7399f062a8c050aa25af2c04a886d58088

  • SHA512

    6c930c97215a39eb774cf616e61b07f260706ccf30ed7cfb0fcc84304b62b276f1b8d56389ff81fb5cc097d59591652cb8d35ee831c00f2c3ea53f9a0d43ba53

  • SSDEEP

    6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtFVHPyvewDpgs5hBhv:3PxPir9RyiIuGcKbpaSL4vtFVHPyvewf

Score
9/10

Malware Config

Signatures

  • Renames multiple (228) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aef8414f1422fa21b0209def99e5db66_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\aef8414f1422fa21b0209def99e5db66_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

    Filesize

    378KB

    MD5

    6d58e75a69d3178c07505fc9d635b17d

    SHA1

    b5f1feeaa03c03a2242c28d4c8ea343e1ead3c2d

    SHA256

    9214f5288d7f9355608258e72653e9b6d09d5fa14c5fde753f76eecb62f1880a

    SHA512

    8dc4e0f256a12e316099ee1dbaa6f791b7a7dbab4782d5e1e420db8a5253556c19dd9480e84a035b86dcb03955b5402c9ccf830cddc2c9aa1cdde002b3bc0a77

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    387KB

    MD5

    fa4f5d8084a4072d88aeb3bb52e0958a

    SHA1

    54a92c20878505bb039ab45d70b51c0d969e425f

    SHA256

    5b372e56b2803029e76bda1c3145c876fc397f04cdc54d18ae5e120be428053c

    SHA512

    ffb1597bda1c9c1c59bc98833b7e438ebd47afdcd0a77f6bd9509fe3a7edd2959226f1f9d2b58a9b89ee03f5ba19bb4453f0b523bd09cf4407a9856ccded49a5