Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    184s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 14:18

General

  • Target

    NEAS.system32exe_JC.exe

  • Size

    9.9MB

  • MD5

    25af599b04074298133944628227451a

  • SHA1

    b23abea6f74e7ffd1fa05436fc952ac652d59342

  • SHA256

    9a88864e3c87f405002960fa5bb710f486e15e7af8c7c2a0a64e6ff4957233f8

  • SHA512

    5ee27fc0fb47a50c26da3804c482f218d239ce250a1f5a0b0b2dc6e4440ea961fa8f19b2d64f37478d807b944d864da712614584825f29832faaa09cac2c0573

  • SSDEEP

    196608:5TYReKrNPFho7UzsyNhaD3fqYz08tHihjnwFXokW8oHDt+:F6DrNPFiksyYI8tkwZoklsx+

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.system32exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.system32exe_JC.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:840
    • \??\c:\users\admin\appdata\local\temp\neas.system32exe_jc.exe 
      c:\users\admin\appdata\local\temp\neas.system32exe_jc.exe 
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2856
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2632
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2892
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1172
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1984
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:22 /f
              6⤵
              • Creates scheduled task(s)
              PID:1868
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:23 /f
              6⤵
              • Creates scheduled task(s)
              PID:1480
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:2792

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\neas.system32exe_jc.exe 

      Filesize

      9.8MB

      MD5

      4aac2cfbd4dab7ab69ddd2c35418965a

      SHA1

      ef11af4171a73774ef4224bddaf561fcb9791176

      SHA256

      bb60c30a3d8781b377268997847f7c1726d6c94c3b0c38dd506954b21167fd49

      SHA512

      15a0e1f26ea331a0257cb029a4f6b6539117f7941cc6967fda4f9dc5560b626d9e22a0c4e812399d83e8a86e1d32bb01ec0bf008d15759381e7c538f252338cc

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      9ce7d914d92dd114ab8e6aa4e36db928

      SHA1

      73a1953f2a1387453691382c9ddc937fc8e36e64

      SHA256

      362dee489fff14f7e028168e8fd4e4ad234be8bcb0a71117e3f6d8d1f012a4ff

      SHA512

      4aec1badf5faf3e900a6ed71a4ded68b69cf8cb06a02c332f50faa32f26574c879153bcc12d589f17910065f0bae066652f4ebe0e8e6b4af7cfef3c70fa54269

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      9ce7d914d92dd114ab8e6aa4e36db928

      SHA1

      73a1953f2a1387453691382c9ddc937fc8e36e64

      SHA256

      362dee489fff14f7e028168e8fd4e4ad234be8bcb0a71117e3f6d8d1f012a4ff

      SHA512

      4aec1badf5faf3e900a6ed71a4ded68b69cf8cb06a02c332f50faa32f26574c879153bcc12d589f17910065f0bae066652f4ebe0e8e6b4af7cfef3c70fa54269

    • C:\Windows\Resources\Themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      b93a0d03c077091f85927f9235ca525a

      SHA1

      e1593134b758dc8242a3647f11d941f1f5efaf40

      SHA256

      2138d1628d36f539ad872562fb2b29991fa2f2a667edabe357a4ec90f44493cc

      SHA512

      271e32b6d9f24dc09c35e29d36c2e8ba2ddb509fab744f84a3cdd7fcffbc720efab16dc9f6b7db33d79d519b72e55f0becd8980af7d36b1d548f6a1d366c6e9d

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      4393b472e85575e14d2a2239ef909af0

      SHA1

      87fd7364e97666c11baa4f3af93607e3aa8297a8

      SHA256

      28cc4ce52a873d5b101038d378f011df8e99a8a5ca51f7778f370b64dd37a3ba

      SHA512

      63aad59feec6306caa74a0bd8fdb2204d9ee165ef5d94678387c55fdad92132638e7394c0d057b2cad59687cc5702bcad5537d115d8becdea89456144deae241

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      4393b472e85575e14d2a2239ef909af0

      SHA1

      87fd7364e97666c11baa4f3af93607e3aa8297a8

      SHA256

      28cc4ce52a873d5b101038d378f011df8e99a8a5ca51f7778f370b64dd37a3ba

      SHA512

      63aad59feec6306caa74a0bd8fdb2204d9ee165ef5d94678387c55fdad92132638e7394c0d057b2cad59687cc5702bcad5537d115d8becdea89456144deae241

    • C:\Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      1c8009422fb2184e7f66fabf15d726ea

      SHA1

      1932d88f750f4ab4f973f5c48e038f0bf189e21b

      SHA256

      d25e93ef3068a8606cb8c69a5eedd3d34e4e89cf4e49806f373bc2d89f71f54b

      SHA512

      23752f982a6b1b4d86521ee52938ca25fe515ce43c536b442b083df3ed3ece63f738dd22f0367f46a00fb57144b969db4935a8689b40d248c525e706abb11f61

    • \??\c:\users\admin\appdata\local\temp\neas.system32exe_jc.exe 

      Filesize

      9.8MB

      MD5

      4aac2cfbd4dab7ab69ddd2c35418965a

      SHA1

      ef11af4171a73774ef4224bddaf561fcb9791176

      SHA256

      bb60c30a3d8781b377268997847f7c1726d6c94c3b0c38dd506954b21167fd49

      SHA512

      15a0e1f26ea331a0257cb029a4f6b6539117f7941cc6967fda4f9dc5560b626d9e22a0c4e812399d83e8a86e1d32bb01ec0bf008d15759381e7c538f252338cc

    • \??\c:\windows\resources\spoolsv.exe

      Filesize

      135KB

      MD5

      4393b472e85575e14d2a2239ef909af0

      SHA1

      87fd7364e97666c11baa4f3af93607e3aa8297a8

      SHA256

      28cc4ce52a873d5b101038d378f011df8e99a8a5ca51f7778f370b64dd37a3ba

      SHA512

      63aad59feec6306caa74a0bd8fdb2204d9ee165ef5d94678387c55fdad92132638e7394c0d057b2cad59687cc5702bcad5537d115d8becdea89456144deae241

    • \??\c:\windows\resources\svchost.exe

      Filesize

      135KB

      MD5

      1c8009422fb2184e7f66fabf15d726ea

      SHA1

      1932d88f750f4ab4f973f5c48e038f0bf189e21b

      SHA256

      d25e93ef3068a8606cb8c69a5eedd3d34e4e89cf4e49806f373bc2d89f71f54b

      SHA512

      23752f982a6b1b4d86521ee52938ca25fe515ce43c536b442b083df3ed3ece63f738dd22f0367f46a00fb57144b969db4935a8689b40d248c525e706abb11f61

    • \??\c:\windows\resources\themes\explorer.exe

      Filesize

      135KB

      MD5

      9ce7d914d92dd114ab8e6aa4e36db928

      SHA1

      73a1953f2a1387453691382c9ddc937fc8e36e64

      SHA256

      362dee489fff14f7e028168e8fd4e4ad234be8bcb0a71117e3f6d8d1f012a4ff

      SHA512

      4aec1badf5faf3e900a6ed71a4ded68b69cf8cb06a02c332f50faa32f26574c879153bcc12d589f17910065f0bae066652f4ebe0e8e6b4af7cfef3c70fa54269

    • \??\c:\windows\resources\themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      b93a0d03c077091f85927f9235ca525a

      SHA1

      e1593134b758dc8242a3647f11d941f1f5efaf40

      SHA256

      2138d1628d36f539ad872562fb2b29991fa2f2a667edabe357a4ec90f44493cc

      SHA512

      271e32b6d9f24dc09c35e29d36c2e8ba2ddb509fab744f84a3cdd7fcffbc720efab16dc9f6b7db33d79d519b72e55f0becd8980af7d36b1d548f6a1d366c6e9d

    • \Users\Admin\AppData\Local\Temp\neas.system32exe_jc.exe 

      Filesize

      9.8MB

      MD5

      4aac2cfbd4dab7ab69ddd2c35418965a

      SHA1

      ef11af4171a73774ef4224bddaf561fcb9791176

      SHA256

      bb60c30a3d8781b377268997847f7c1726d6c94c3b0c38dd506954b21167fd49

      SHA512

      15a0e1f26ea331a0257cb029a4f6b6539117f7941cc6967fda4f9dc5560b626d9e22a0c4e812399d83e8a86e1d32bb01ec0bf008d15759381e7c538f252338cc

    • \Users\Admin\AppData\Local\Temp\neas.system32exe_jc.exe 

      Filesize

      9.8MB

      MD5

      4aac2cfbd4dab7ab69ddd2c35418965a

      SHA1

      ef11af4171a73774ef4224bddaf561fcb9791176

      SHA256

      bb60c30a3d8781b377268997847f7c1726d6c94c3b0c38dd506954b21167fd49

      SHA512

      15a0e1f26ea331a0257cb029a4f6b6539117f7941cc6967fda4f9dc5560b626d9e22a0c4e812399d83e8a86e1d32bb01ec0bf008d15759381e7c538f252338cc

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      9ce7d914d92dd114ab8e6aa4e36db928

      SHA1

      73a1953f2a1387453691382c9ddc937fc8e36e64

      SHA256

      362dee489fff14f7e028168e8fd4e4ad234be8bcb0a71117e3f6d8d1f012a4ff

      SHA512

      4aec1badf5faf3e900a6ed71a4ded68b69cf8cb06a02c332f50faa32f26574c879153bcc12d589f17910065f0bae066652f4ebe0e8e6b4af7cfef3c70fa54269

    • \Windows\Resources\Themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      b93a0d03c077091f85927f9235ca525a

      SHA1

      e1593134b758dc8242a3647f11d941f1f5efaf40

      SHA256

      2138d1628d36f539ad872562fb2b29991fa2f2a667edabe357a4ec90f44493cc

      SHA512

      271e32b6d9f24dc09c35e29d36c2e8ba2ddb509fab744f84a3cdd7fcffbc720efab16dc9f6b7db33d79d519b72e55f0becd8980af7d36b1d548f6a1d366c6e9d

    • \Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      4393b472e85575e14d2a2239ef909af0

      SHA1

      87fd7364e97666c11baa4f3af93607e3aa8297a8

      SHA256

      28cc4ce52a873d5b101038d378f011df8e99a8a5ca51f7778f370b64dd37a3ba

      SHA512

      63aad59feec6306caa74a0bd8fdb2204d9ee165ef5d94678387c55fdad92132638e7394c0d057b2cad59687cc5702bcad5537d115d8becdea89456144deae241

    • \Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      4393b472e85575e14d2a2239ef909af0

      SHA1

      87fd7364e97666c11baa4f3af93607e3aa8297a8

      SHA256

      28cc4ce52a873d5b101038d378f011df8e99a8a5ca51f7778f370b64dd37a3ba

      SHA512

      63aad59feec6306caa74a0bd8fdb2204d9ee165ef5d94678387c55fdad92132638e7394c0d057b2cad59687cc5702bcad5537d115d8becdea89456144deae241

    • \Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      1c8009422fb2184e7f66fabf15d726ea

      SHA1

      1932d88f750f4ab4f973f5c48e038f0bf189e21b

      SHA256

      d25e93ef3068a8606cb8c69a5eedd3d34e4e89cf4e49806f373bc2d89f71f54b

      SHA512

      23752f982a6b1b4d86521ee52938ca25fe515ce43c536b442b083df3ed3ece63f738dd22f0367f46a00fb57144b969db4935a8689b40d248c525e706abb11f61

    • \Windows\System32\d3dcompiler_43.dll

      Filesize

      2.4MB

      MD5

      ada0c39d4eacdc81fd84163a95d62079

      SHA1

      207321f1b449985b2d06ed50b989fa6259e4eb8e

      SHA256

      44c3a7e330b54a35a9efa015831392593aa02e7da1460be429d17c3644850e8a

      SHA512

      1afc63db5d2030b76abc19094fc9fef28cc6250bd265294647e65db81f13749c867722924460f7a6021c739f4057f95501f0322cdec28a2101bf94164557a1a5

    • \Windows\System32\d3dx11_43.dll

      Filesize

      270KB

      MD5

      9d6429f410597750b2dc2579b2347303

      SHA1

      e35acb15ea52f6cd0587b4ca8da0486b859fd048

      SHA256

      981e42629df751217406e7150477cddc853b79abd6a8568a1566298ed8f7bd59

      SHA512

      46cbfb1e22c3f469bdc80515560448f6f83607fd6974bb68b9c7f86ca10c69878f1312b32c81c0f57b931c43bad80bd46bdf26ab4ffb999abb0b73de27ad7c56

    • memory/840-39-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/840-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/840-33-0x00000000003D0000-0x00000000003EF000-memory.dmp

      Filesize

      124KB

    • memory/1172-84-0x00000000003A0000-0x00000000003BF000-memory.dmp

      Filesize

      124KB

    • memory/1984-88-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2632-90-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2744-21-0x0000000140000000-0x0000000141821000-memory.dmp

      Filesize

      24.1MB

    • memory/2744-15-0x0000000077140000-0x0000000077142000-memory.dmp

      Filesize

      8KB

    • memory/2744-56-0x0000000180000000-0x00000001803B3000-memory.dmp

      Filesize

      3.7MB

    • memory/2744-22-0x0000000077150000-0x0000000077152000-memory.dmp

      Filesize

      8KB

    • memory/2744-61-0x0000000140000000-0x0000000141821000-memory.dmp

      Filesize

      24.1MB

    • memory/2744-62-0x0000000076F90000-0x0000000077139000-memory.dmp

      Filesize

      1.7MB

    • memory/2744-32-0x0000000076F90000-0x0000000077139000-memory.dmp

      Filesize

      1.7MB

    • memory/2744-19-0x0000000077150000-0x0000000077152000-memory.dmp

      Filesize

      8KB

    • memory/2744-46-0x0000000180000000-0x00000001803B3000-memory.dmp

      Filesize

      3.7MB

    • memory/2744-27-0x0000000140000000-0x0000000141821000-memory.dmp

      Filesize

      24.1MB

    • memory/2744-17-0x0000000077150000-0x0000000077152000-memory.dmp

      Filesize

      8KB

    • memory/2744-16-0x0000000076F90000-0x0000000077139000-memory.dmp

      Filesize

      1.7MB

    • memory/2744-14-0x0000000140000000-0x0000000141821000-memory.dmp

      Filesize

      24.1MB

    • memory/2744-12-0x0000000077140000-0x0000000077142000-memory.dmp

      Filesize

      8KB

    • memory/2744-50-0x0000000180000000-0x00000001803B3000-memory.dmp

      Filesize

      3.7MB

    • memory/2744-10-0x0000000077140000-0x0000000077142000-memory.dmp

      Filesize

      8KB

    • memory/2856-36-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2856-69-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2892-89-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB