Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
-
Size
479KB
-
MD5
9851a2d1286ff5b49c70df955455f307
-
SHA1
72fcb74da7ef60348112ab39704440d9c2cd28c7
-
SHA256
04a420cf0f6b299c574f027b6647fdde90ebf3b767ac74bf367a94f5d84c5863
-
SHA512
6d2cc11833a1c64a2151343491990d115555dc5e4e3dd8ed5d62bce4c30097d20e1f78b524ccae7e99d6fac91aa8b3c9f4cf8a63f3906e9005efafd82ab484ad
-
SSDEEP
12288:aVlc87eqqV5e+wBV6O+b2ejjE0n5cS1fGyZrQ6K:aVSqqHeVBxgD0Q1fGyZk6K
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2412 ktmuocom.exe 2120 ~A40C.tmp 2764 Dispelog.exe -
Loads dropped DLL 3 IoCs
pid Process 1600 NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe 1600 NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe 2412 ktmuocom.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\mcbuetup = "C:\\Users\\Admin\\AppData\\Roaming\\Searcont\\ktmuocom.exe" NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dispelog.exe NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 ktmuocom.exe 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1212 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2412 ktmuocom.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2412 1600 NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe 28 PID 1600 wrote to memory of 2412 1600 NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe 28 PID 1600 wrote to memory of 2412 1600 NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe 28 PID 1600 wrote to memory of 2412 1600 NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe 28 PID 2412 wrote to memory of 2120 2412 ktmuocom.exe 29 PID 2412 wrote to memory of 2120 2412 ktmuocom.exe 29 PID 2412 wrote to memory of 2120 2412 ktmuocom.exe 29 PID 2412 wrote to memory of 2120 2412 ktmuocom.exe 29 PID 2120 wrote to memory of 1212 2120 ~A40C.tmp 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe"C:\Users\Admin\AppData\Roaming\Searcont"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\~A40C.tmp1212 490504 2412 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120
-
-
-
-
C:\Windows\SysWOW64\Dispelog.exeC:\Windows\SysWOW64\Dispelog.exe -s1⤵
- Executes dropped EXE
PID:2764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6
-
Filesize
479KB
MD5096cbc5438f5277e6398888cbcd966e3
SHA16f4c95f883d0e1efa48bf649bbb0a00135fbc271
SHA2561c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1
SHA51230f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6