Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
06/10/2023, 13:01
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe
-
Size
395KB
-
MD5
b0d488ccf7300355a469d92244a5090a
-
SHA1
5d427a6894a822f46138282daa0acbf361a81303
-
SHA256
91a370ad9a1fd97ce3d2fa1732f026c3b9c5ad7ef80b310f92b65db41ea63268
-
SHA512
cbb8783e8a90a1dc4ba573f22a079e458a48b23f26b2347da17da2f941ff8ab49ff3332345bae8fe83551c02dec89263fd113c2ba34dcda2cda9f53dcb52ed36
-
SSDEEP
6144:gdspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70Nqx:G8kxNhOZElO5kkWjhD4AF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2744 EIN.EXE -
Loads dropped DLL 2 IoCs
pid Process 2388 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 2388 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\QROCJVU.EXE \"%1\" %*" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EIN.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BUPCB.EXE = "C:\\Program Files (x86)\\BUPCB.EXE" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Enumerates connected drives 3 TTPs 34 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\Q: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\G: EIN.EXE File opened (read-only) \??\H: EIN.EXE File opened (read-only) \??\K: EIN.EXE File opened (read-only) \??\L: EIN.EXE File opened (read-only) \??\J: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\E: EIN.EXE File opened (read-only) \??\S: EIN.EXE File opened (read-only) \??\P: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\V: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\R: EIN.EXE File opened (read-only) \??\G: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\T: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\M: EIN.EXE File opened (read-only) \??\T: EIN.EXE File opened (read-only) \??\K: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\L: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\R: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\J: EIN.EXE File opened (read-only) \??\O: EIN.EXE File opened (read-only) \??\M: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\N: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\S: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\I: EIN.EXE File opened (read-only) \??\P: EIN.EXE File opened (read-only) \??\Q: EIN.EXE File opened (read-only) \??\U: EIN.EXE File opened (read-only) \??\V: EIN.EXE File opened (read-only) \??\H: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\I: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\N: EIN.EXE File opened (read-only) \??\O: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\U: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\BUPCB.EXE NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File created C:\Program Files\BZVB.EXE EIN.EXE File created C:\Program Files\MEFU.EXE EIN.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\QROCJVU.EXE NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened for modification C:\Windows\QROCJVU.EXE NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell EIN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\$Recycle.Bin\\YZT.EXE %1" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Windows\\QROCJVU.EXE %1" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\$Recycle.Bin\\QOY.EXE \"%1\"" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile EIN.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\$Recycle.Bin\\JDD.EXE \"%1\"" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command EIN.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\QROCJVU.EXE \"%1\" %*" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command EIN.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2744 2388 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 28 PID 2388 wrote to memory of 2744 2388 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 28 PID 2388 wrote to memory of 2744 2388 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 28 PID 2388 wrote to memory of 2744 2388 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\$Recycle.Bin\EIN.EXEC:\$Recycle.Bin\EIN.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5a3b35adb476bcd04f5e0188d077a01f0
SHA11d7a231c48f96f06a192c8d74e5cd5309a685344
SHA2564f86097b52df44df93efd46205a16449e256287a8104198e89e8d43b06cd38e6
SHA5123f925dd76517c46fd793eda90274080823ad313cc7f9af59c6f05859767e23b5fe131908d3c21f23654244d004783e921165bc9a232eb248d799af56435d27c2
-
Filesize
395KB
MD5a3b35adb476bcd04f5e0188d077a01f0
SHA11d7a231c48f96f06a192c8d74e5cd5309a685344
SHA2564f86097b52df44df93efd46205a16449e256287a8104198e89e8d43b06cd38e6
SHA5123f925dd76517c46fd793eda90274080823ad313cc7f9af59c6f05859767e23b5fe131908d3c21f23654244d004783e921165bc9a232eb248d799af56435d27c2
-
Filesize
395KB
MD5072e658754016e880ab4636329819e97
SHA1f405b4772fd72de7cba9b583df1f43ddbf624382
SHA25616ff30cee8177e94e28453b9cdb32e28e87f6d0725c70db9988907698d8f279b
SHA5122815ba120a58561ba80e6a282a49f71509de3444ac74b4c04a389d0b5955236f4a6885dda1167a875546c60fb0b89aa3155c4e3b81158c4367191d025ca1110a
-
Filesize
395KB
MD5a3b35adb476bcd04f5e0188d077a01f0
SHA11d7a231c48f96f06a192c8d74e5cd5309a685344
SHA2564f86097b52df44df93efd46205a16449e256287a8104198e89e8d43b06cd38e6
SHA5123f925dd76517c46fd793eda90274080823ad313cc7f9af59c6f05859767e23b5fe131908d3c21f23654244d004783e921165bc9a232eb248d799af56435d27c2
-
Filesize
395KB
MD5a3b35adb476bcd04f5e0188d077a01f0
SHA11d7a231c48f96f06a192c8d74e5cd5309a685344
SHA2564f86097b52df44df93efd46205a16449e256287a8104198e89e8d43b06cd38e6
SHA5123f925dd76517c46fd793eda90274080823ad313cc7f9af59c6f05859767e23b5fe131908d3c21f23654244d004783e921165bc9a232eb248d799af56435d27c2