Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 16:25
General
-
Target
NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
-
Size
479KB
-
MD5
9851a2d1286ff5b49c70df955455f307
-
SHA1
72fcb74da7ef60348112ab39704440d9c2cd28c7
-
SHA256
04a420cf0f6b299c574f027b6647fdde90ebf3b767ac74bf367a94f5d84c5863
-
SHA512
6d2cc11833a1c64a2151343491990d115555dc5e4e3dd8ed5d62bce4c30097d20e1f78b524ccae7e99d6fac91aa8b3c9f4cf8a63f3906e9005efafd82ab484ad
-
SSDEEP
12288:aVlc87eqqV5e+wBV6O+b2ejjE0n5cS1fGyZrQ6K:aVSqqHeVBxgD0Q1fGyZk6K
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\newdvate\MRINHost.exe"C:\Users\Admin\AppData\Roaming\newdvate"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~E2CE.tmp3188 490504 4500 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\charedit.exeC:\Windows\SysWOW64\charedit.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
479KB
MD5b8193c8ca427c337cb1c918281623657
SHA14654c6062a37bc4bd039dccf8c07fe4aae0e822b
SHA2562db25d3905dd0079afaf670c436be802628c7c91b2f5d6fac7b24cef424da703
SHA512e0c0b999884593b4d9034ede1e9cc959decde3d785ad00a880d133c4af84300c7316f3e3e491f7578ac7d7bbb10818cf8bf5cc0a0da69ea8dfd5085e373a8c0f
-
Filesize
479KB
MD5b8193c8ca427c337cb1c918281623657
SHA14654c6062a37bc4bd039dccf8c07fe4aae0e822b
SHA2562db25d3905dd0079afaf670c436be802628c7c91b2f5d6fac7b24cef424da703
SHA512e0c0b999884593b4d9034ede1e9cc959decde3d785ad00a880d133c4af84300c7316f3e3e491f7578ac7d7bbb10818cf8bf5cc0a0da69ea8dfd5085e373a8c0f
-
Filesize
479KB
MD5b8193c8ca427c337cb1c918281623657
SHA14654c6062a37bc4bd039dccf8c07fe4aae0e822b
SHA2562db25d3905dd0079afaf670c436be802628c7c91b2f5d6fac7b24cef424da703
SHA512e0c0b999884593b4d9034ede1e9cc959decde3d785ad00a880d133c4af84300c7316f3e3e491f7578ac7d7bbb10818cf8bf5cc0a0da69ea8dfd5085e373a8c0f
-
Filesize
479KB
MD5b8193c8ca427c337cb1c918281623657
SHA14654c6062a37bc4bd039dccf8c07fe4aae0e822b
SHA2562db25d3905dd0079afaf670c436be802628c7c91b2f5d6fac7b24cef424da703
SHA512e0c0b999884593b4d9034ede1e9cc959decde3d785ad00a880d133c4af84300c7316f3e3e491f7578ac7d7bbb10818cf8bf5cc0a0da69ea8dfd5085e373a8c0f
-
Filesize
24KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
52KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
512KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
20KB
-
Filesize
520KB
-
Filesize
512KB