Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 19:44

General

  • Target

    NEAS.b45f6580dd149801c80bbe23a70950bf_JC.exe

  • Size

    67KB

  • MD5

    b45f6580dd149801c80bbe23a70950bf

  • SHA1

    c48c5cc3829bc98cb14a649674866595d6786837

  • SHA256

    b0f2d91e0a074f01c9c1dfbf21046b6f9ef90de5a9e9df8798934abf39a76ef7

  • SHA512

    20d83180f317fc701f14712451bbf4fa54e75dc4114111ddccbb8d30ebb91da0c0ed05cf39dd250e36a3eff02c984d030d7419e0151443bf1b0a846521a471c3

  • SSDEEP

    1536:/Ao0zj2d6rnJYulBJnDQEEa1EfBE+1EC1p1E1aE1E1EEE1+BX1EE9h1EJvY1kwvb:/AoAliulHnDQEEa1EfBE+1EC1p1E1aEe

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.b45f6580dd149801c80bbe23a70950bf_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b45f6580dd149801c80bbe23a70950bf_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    68KB

    MD5

    669b467878ec10a138b033e708aaf2d6

    SHA1

    2249f65a6824830c9a63f97bd804384749e56881

    SHA256

    c3c500516b7e31c0edfc20f0df6f4d70f98058b7973dc313afc1a8cc0140c762

    SHA512

    22bbcebfebf1b4cc4e037a8afcc960bf1cf18b1705d9adf48ca9250ccc6026afcf1b0da91b8f0ad5e7a14c989000117519d6541ff459b9b98fd0f6dd38b5358e

  • C:\Windows\microsofthelp.exe

    Filesize

    68KB

    MD5

    669b467878ec10a138b033e708aaf2d6

    SHA1

    2249f65a6824830c9a63f97bd804384749e56881

    SHA256

    c3c500516b7e31c0edfc20f0df6f4d70f98058b7973dc313afc1a8cc0140c762

    SHA512

    22bbcebfebf1b4cc4e037a8afcc960bf1cf18b1705d9adf48ca9250ccc6026afcf1b0da91b8f0ad5e7a14c989000117519d6541ff459b9b98fd0f6dd38b5358e

  • C:\Windows\microsofthelp.exe

    Filesize

    68KB

    MD5

    669b467878ec10a138b033e708aaf2d6

    SHA1

    2249f65a6824830c9a63f97bd804384749e56881

    SHA256

    c3c500516b7e31c0edfc20f0df6f4d70f98058b7973dc313afc1a8cc0140c762

    SHA512

    22bbcebfebf1b4cc4e037a8afcc960bf1cf18b1705d9adf48ca9250ccc6026afcf1b0da91b8f0ad5e7a14c989000117519d6541ff459b9b98fd0f6dd38b5358e

  • memory/2080-9-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2080-11-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2452-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2452-7-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2452-6-0x0000000000220000-0x000000000022D000-memory.dmp

    Filesize

    52KB