Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2023, 13:01
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe
-
Size
395KB
-
MD5
b0d488ccf7300355a469d92244a5090a
-
SHA1
5d427a6894a822f46138282daa0acbf361a81303
-
SHA256
91a370ad9a1fd97ce3d2fa1732f026c3b9c5ad7ef80b310f92b65db41ea63268
-
SHA512
cbb8783e8a90a1dc4ba573f22a079e458a48b23f26b2347da17da2f941ff8ab49ff3332345bae8fe83551c02dec89263fd113c2ba34dcda2cda9f53dcb52ed36
-
SSDEEP
6144:gdspDeDrxkg/vrMuJIgwhEFHyOrJcX/Pgqwzm5IzkWjS4e4azExBKO1t4Kb70Nqx:G8kxNhOZElO5kkWjhD4AF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4232 OLD.EXE -
Modifies system executable filetype association 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\odt\\HBI.EXE \"%1\" %*" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command OLD.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HBI.EXE = "C:\\odt\\HBI.EXE" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\S: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\T: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\Q: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\R: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\U: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\V: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\H: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\K: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\L: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\G: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\N: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\P: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\M: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\E: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\I: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe File opened (read-only) \??\J: NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\odt\\HBI.EXE \"%1\" %*" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\System Volume Information\\VXHCKO.EXE %1" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\System Volume Information\\VXHCKO.EXE \"%1\"" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\System Volume Information\\VXHCKO.EXE \"%1\"" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command OLD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\odt\\HBI.EXE %1" NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4232 OLD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2860 wrote to memory of 4232 2860 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 86 PID 2860 wrote to memory of 4232 2860 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 86 PID 2860 wrote to memory of 4232 2860 NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b0d488ccf7300355a469d92244a5090aexe_JC.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\odt\OLD.EXEC:\odt\OLD.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4232
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD55047225c2e7ad58a6b8b0e3bae2da11d
SHA19e5f6d0b7a4d9945fa8cb73bdd0cb94398f62bd2
SHA2565c36db1480c2167ba0cb4d88ba2db7beec8b6ba4efeb7a522aeb0067e87caed9
SHA5126c9285e7492592f93d861eecf1c0fbea85b52d78b049af20e437df2c89d3bfab6a15d4722632ec5cf7dc1f9724a3fb8b3d2e92ec51915f7ac111ab462289ab4a
-
Filesize
395KB
MD5dc488fad24e40d6c51729e4b8201c72a
SHA16aa54717cb2af5597de18e8fb7437cab4bc8000b
SHA256e0d873b6fd1f58726ded0993f042e12c2fcccd49b59ce82d4e913d1ea1b84f1a
SHA5121e733329971f5d3c7f836ad7ddfe4feac1a6577a47ac4ed3e225826828ab96845680ae75833f72f4a326b95e87e9246cfbbbf49e4b94558ab7ec940e45196115
-
Filesize
395KB
MD5dc488fad24e40d6c51729e4b8201c72a
SHA16aa54717cb2af5597de18e8fb7437cab4bc8000b
SHA256e0d873b6fd1f58726ded0993f042e12c2fcccd49b59ce82d4e913d1ea1b84f1a
SHA5121e733329971f5d3c7f836ad7ddfe4feac1a6577a47ac4ed3e225826828ab96845680ae75833f72f4a326b95e87e9246cfbbbf49e4b94558ab7ec940e45196115