Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2023, 19:44

General

  • Target

    NEAS.b45f6580dd149801c80bbe23a70950bf_JC.exe

  • Size

    67KB

  • MD5

    b45f6580dd149801c80bbe23a70950bf

  • SHA1

    c48c5cc3829bc98cb14a649674866595d6786837

  • SHA256

    b0f2d91e0a074f01c9c1dfbf21046b6f9ef90de5a9e9df8798934abf39a76ef7

  • SHA512

    20d83180f317fc701f14712451bbf4fa54e75dc4114111ddccbb8d30ebb91da0c0ed05cf39dd250e36a3eff02c984d030d7419e0151443bf1b0a846521a471c3

  • SSDEEP

    1536:/Ao0zj2d6rnJYulBJnDQEEa1EfBE+1EC1p1E1aE1E1EEE1+BX1EE9h1EJvY1kwvb:/AoAliulHnDQEEa1EfBE+1EC1p1E1aEe

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.b45f6580dd149801c80bbe23a70950bf_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b45f6580dd149801c80bbe23a70950bf_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    68KB

    MD5

    669b467878ec10a138b033e708aaf2d6

    SHA1

    2249f65a6824830c9a63f97bd804384749e56881

    SHA256

    c3c500516b7e31c0edfc20f0df6f4d70f98058b7973dc313afc1a8cc0140c762

    SHA512

    22bbcebfebf1b4cc4e037a8afcc960bf1cf18b1705d9adf48ca9250ccc6026afcf1b0da91b8f0ad5e7a14c989000117519d6541ff459b9b98fd0f6dd38b5358e

  • C:\Windows\microsofthelp.exe

    Filesize

    68KB

    MD5

    669b467878ec10a138b033e708aaf2d6

    SHA1

    2249f65a6824830c9a63f97bd804384749e56881

    SHA256

    c3c500516b7e31c0edfc20f0df6f4d70f98058b7973dc313afc1a8cc0140c762

    SHA512

    22bbcebfebf1b4cc4e037a8afcc960bf1cf18b1705d9adf48ca9250ccc6026afcf1b0da91b8f0ad5e7a14c989000117519d6541ff459b9b98fd0f6dd38b5358e

  • memory/1264-6-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1292-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1292-4-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB