Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 18:46

General

  • Target

    NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe

  • Size

    896KB

  • MD5

    f8df8edeb8b4cd0fd386f4e44dde6bdd

  • SHA1

    c2b72c5284cf79cdcd21ccb06278020d0a44006b

  • SHA256

    1eb9d5d7b5bbef52c15d846559a9fc5a8953f1e0db4f80bd8b73b5374ace3fa8

  • SHA512

    0a48664407f749339fcaa48cda14e91b9a1d1b39aad416a1c71ba7479ed468cbf5a90114f197a59303e12c0d01c22d7cc6ad1fee1953e93e42bc78af0058dea9

  • SSDEEP

    24576:kkTRTGryZ5d9TRTGryaITRTGryZ5d9TRTGryeLTRTGryZ5d9TRTGryaITRTGryZB:j9bD99wI9bD99e9bD99wI9bD99

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 6 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\Enhacojl.exe
      C:\Windows\system32\Enhacojl.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\Fkckeh32.exe
        C:\Windows\system32\Fkckeh32.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 140
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Enhacojl.exe

    Filesize

    896KB

    MD5

    4ac8bc455aceffaaaa98e4ac895285b3

    SHA1

    7a6de1ccb834024b715c2527663d3771ddba4541

    SHA256

    3c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35

    SHA512

    f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95

  • C:\Windows\SysWOW64\Enhacojl.exe

    Filesize

    896KB

    MD5

    4ac8bc455aceffaaaa98e4ac895285b3

    SHA1

    7a6de1ccb834024b715c2527663d3771ddba4541

    SHA256

    3c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35

    SHA512

    f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95

  • C:\Windows\SysWOW64\Enhacojl.exe

    Filesize

    896KB

    MD5

    4ac8bc455aceffaaaa98e4ac895285b3

    SHA1

    7a6de1ccb834024b715c2527663d3771ddba4541

    SHA256

    3c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35

    SHA512

    f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95

  • C:\Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • C:\Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • \Windows\SysWOW64\Enhacojl.exe

    Filesize

    896KB

    MD5

    4ac8bc455aceffaaaa98e4ac895285b3

    SHA1

    7a6de1ccb834024b715c2527663d3771ddba4541

    SHA256

    3c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35

    SHA512

    f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95

  • \Windows\SysWOW64\Enhacojl.exe

    Filesize

    896KB

    MD5

    4ac8bc455aceffaaaa98e4ac895285b3

    SHA1

    7a6de1ccb834024b715c2527663d3771ddba4541

    SHA256

    3c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35

    SHA512

    f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    896KB

    MD5

    db9a3e10f1605db7b83a8005b5016b78

    SHA1

    99a92ba89638bf515725159c7efc704805e492c8

    SHA256

    ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f

    SHA512

    06578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd

  • memory/1140-26-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1712-0-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1712-6-0x00000000001C0000-0x00000000001F3000-memory.dmp

    Filesize

    204KB

  • memory/1712-31-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2696-24-0x0000000000220000-0x0000000000253000-memory.dmp

    Filesize

    204KB

  • memory/2696-32-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB