Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe
-
Size
130KB
-
MD5
072d6924081bb27311a97c4f090f4af0
-
SHA1
3b97b3a222625183bd18f71db17175ba53f879ae
-
SHA256
cbaa747ad51574c8323d5676714c3bb7adb66dda5660c6e2156d3d8d8d8ab201
-
SHA512
0f8a3e643b7bf9f7d3cd0120fe61e3d06adf2213b48a6e820f0bbdcaacdacc1711668b9976250d1760244dfd05ca260a1e5f79125fef06ffe5279607ec0efdfd
-
SSDEEP
1536:3xJXH2aHwM7saKGkuoN1AG8DnTd6bGqQxuMZBtiR:3xQM7VkuoN1LGnJyQxup
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 2988 lifikuri.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3832 wrote to memory of 2988 3832 NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe 82 PID 3832 wrote to memory of 2988 3832 NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe 82 PID 3832 wrote to memory of 2988 3832 NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.072d6924081bb27311a97c4f090f4af0_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\lifikuri.exe"C:\Users\Admin\AppData\Local\Temp\lifikuri.exe"2⤵
- Executes dropped EXE
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD55117517dfde58610603c84e6bd67c6c6
SHA1a0b31f3bd6a27ca8effafba6b618dfaf9dfa0092
SHA25657740736335848ee9320d37347df4bdd20b0d72f5874f9b663a0b325f6a93519
SHA512da27a880dca65f25bcce2c32bd96db8ff1f82e57454719c011c73aa0e3576bb16b93e9f5a38da840498328c9485482dd6d10d8ec2424ffd526a78ce503ced414
-
Filesize
130KB
MD55117517dfde58610603c84e6bd67c6c6
SHA1a0b31f3bd6a27ca8effafba6b618dfaf9dfa0092
SHA25657740736335848ee9320d37347df4bdd20b0d72f5874f9b663a0b325f6a93519
SHA512da27a880dca65f25bcce2c32bd96db8ff1f82e57454719c011c73aa0e3576bb16b93e9f5a38da840498328c9485482dd6d10d8ec2424ffd526a78ce503ced414
-
Filesize
130KB
MD55117517dfde58610603c84e6bd67c6c6
SHA1a0b31f3bd6a27ca8effafba6b618dfaf9dfa0092
SHA25657740736335848ee9320d37347df4bdd20b0d72f5874f9b663a0b325f6a93519
SHA512da27a880dca65f25bcce2c32bd96db8ff1f82e57454719c011c73aa0e3576bb16b93e9f5a38da840498328c9485482dd6d10d8ec2424ffd526a78ce503ced414