Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 00:45

General

  • Target

    7ff18b22a074afb8863c6ce1696f0315237022e1ec18641fbf2c91cfb3e3a749.exe

  • Size

    132KB

  • MD5

    13204159358b8c95555fbe92d48c11d0

  • SHA1

    561b4ccfb2329d3a0c328a0d545c61b3301f3d13

  • SHA256

    7ff18b22a074afb8863c6ce1696f0315237022e1ec18641fbf2c91cfb3e3a749

  • SHA512

    2b29315ad2cf1ddd996615ff1bbf8f9718c9d5b9c90e4a66e90911de6117424bacee78caf5721e643b921f59103dc37315017616f88b906f386443714a141a92

  • SSDEEP

    3072:0fHcxsYbtX6RzvyuOi89Sey1AKWZXl7miWmn/Aoe:0f3OtX6RzvyuOQesWbScA

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ff18b22a074afb8863c6ce1696f0315237022e1ec18641fbf2c91cfb3e3a749.exe
    "C:\Users\Admin\AppData\Local\Temp\7ff18b22a074afb8863c6ce1696f0315237022e1ec18641fbf2c91cfb3e3a749.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Users\Admin\neomieq.exe
      "C:\Users\Admin\neomieq.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\neomieq.exe

    Filesize

    132KB

    MD5

    1d38bcdf5957279ea6aa19e9e2be14f5

    SHA1

    a7e8aa9d941f0796e46bdb78bc7f317fdaf8bf58

    SHA256

    f3208fa2e5bb42b8d79e74702d823099719e3ff8e285611a984ec8c0981e199f

    SHA512

    69e4c4ac6bc39ada6bedfa9a5728afa0024bf43eedc9f4684c1a99f5483e91f615b97e2454fd88e612d1813b679607c79062fe1fc583e58c7b53168b517492a9

  • C:\Users\Admin\neomieq.exe

    Filesize

    132KB

    MD5

    1d38bcdf5957279ea6aa19e9e2be14f5

    SHA1

    a7e8aa9d941f0796e46bdb78bc7f317fdaf8bf58

    SHA256

    f3208fa2e5bb42b8d79e74702d823099719e3ff8e285611a984ec8c0981e199f

    SHA512

    69e4c4ac6bc39ada6bedfa9a5728afa0024bf43eedc9f4684c1a99f5483e91f615b97e2454fd88e612d1813b679607c79062fe1fc583e58c7b53168b517492a9