Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe
-
Size
896KB
-
MD5
f8df8edeb8b4cd0fd386f4e44dde6bdd
-
SHA1
c2b72c5284cf79cdcd21ccb06278020d0a44006b
-
SHA256
1eb9d5d7b5bbef52c15d846559a9fc5a8953f1e0db4f80bd8b73b5374ace3fa8
-
SHA512
0a48664407f749339fcaa48cda14e91b9a1d1b39aad416a1c71ba7479ed468cbf5a90114f197a59303e12c0d01c22d7cc6ad1fee1953e93e42bc78af0058dea9
-
SSDEEP
24576:kkTRTGryZ5d9TRTGryaITRTGryZ5d9TRTGryeLTRTGryZ5d9TRTGryaITRTGryZB:j9bD99wI9bD99e9bD99wI9bD99
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enhacojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Enhacojl.exe -
Executes dropped EXE 2 IoCs
pid Process 2696 Enhacojl.exe 1140 Fkckeh32.exe -
Loads dropped DLL 8 IoCs
pid Process 1712 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe 1712 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe 2696 Enhacojl.exe 2696 Enhacojl.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe 2128 WerFault.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\Enhacojl.exe NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe File opened for modification C:\Windows\SysWOW64\Enhacojl.exe NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe File created C:\Windows\SysWOW64\Ampehe32.dll NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe File created C:\Windows\SysWOW64\Fkckeh32.exe Enhacojl.exe File opened for modification C:\Windows\SysWOW64\Fkckeh32.exe Enhacojl.exe File created C:\Windows\SysWOW64\Clkmne32.dll Enhacojl.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2128 1140 WerFault.exe 29 -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampehe32.dll" NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Enhacojl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll" Enhacojl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Enhacojl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2696 1712 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe 28 PID 1712 wrote to memory of 2696 1712 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe 28 PID 1712 wrote to memory of 2696 1712 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe 28 PID 1712 wrote to memory of 2696 1712 NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe 28 PID 2696 wrote to memory of 1140 2696 Enhacojl.exe 29 PID 2696 wrote to memory of 1140 2696 Enhacojl.exe 29 PID 2696 wrote to memory of 1140 2696 Enhacojl.exe 29 PID 2696 wrote to memory of 1140 2696 Enhacojl.exe 29 PID 1140 wrote to memory of 2128 1140 Fkckeh32.exe 30 PID 1140 wrote to memory of 2128 1140 Fkckeh32.exe 30 PID 1140 wrote to memory of 2128 1140 Fkckeh32.exe 30 PID 1140 wrote to memory of 2128 1140 Fkckeh32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f8df8edeb8b4cd0fd386f4e44dde6bdd_JC.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\Enhacojl.exeC:\Windows\system32\Enhacojl.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Fkckeh32.exeC:\Windows\system32\Fkckeh32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1404⤵
- Loads dropped DLL
- Program crash
PID:2128
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD54ac8bc455aceffaaaa98e4ac895285b3
SHA17a6de1ccb834024b715c2527663d3771ddba4541
SHA2563c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35
SHA512f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95
-
Filesize
896KB
MD54ac8bc455aceffaaaa98e4ac895285b3
SHA17a6de1ccb834024b715c2527663d3771ddba4541
SHA2563c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35
SHA512f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95
-
Filesize
896KB
MD54ac8bc455aceffaaaa98e4ac895285b3
SHA17a6de1ccb834024b715c2527663d3771ddba4541
SHA2563c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35
SHA512f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD54ac8bc455aceffaaaa98e4ac895285b3
SHA17a6de1ccb834024b715c2527663d3771ddba4541
SHA2563c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35
SHA512f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95
-
Filesize
896KB
MD54ac8bc455aceffaaaa98e4ac895285b3
SHA17a6de1ccb834024b715c2527663d3771ddba4541
SHA2563c12dcd1a837b405f8b0bdf366a27566bb25166e8e3baa9f6c44a4622b99cb35
SHA512f565ae6f490bd66724e997d7021f543a79f82023c9ad255cd4c1139703ccd601528f68207a8e45e968d611f2ed535e689cf5dd846bb4314ba566d86869558d95
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd
-
Filesize
896KB
MD5db9a3e10f1605db7b83a8005b5016b78
SHA199a92ba89638bf515725159c7efc704805e492c8
SHA256ba7c2e649c580c9d2990c4036eccf462f3832342279c513cf976e220f1dac99f
SHA51206578a1756b5bc3085a810041d6d57497dc70ab540e89b1ae9bdb1f887ab50f7e28f09518a14435b671b5ecb134f145b366d000f0f4e6e8dd12f645833002ddd