Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe
-
Size
1.4MB
-
MD5
4b45423fa806ba12d099173f6b4126f0
-
SHA1
86b3f3ed6db3b6dd024359cff9f684d7f7d32903
-
SHA256
e38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bc
-
SHA512
deb0c606169094f47f386f66f41a76011e7ed3710d50d5bd682437054ac1e8a671fa36d0d5e79d50d2debc2b3b104fcdf0831054a40b7b555a30c54e44188a8b
-
SSDEEP
24576:1yi2HBkN0hhWOga7AeHidUXuVVN8mwpKfLTBHBf/WA7hO/f6abYEsYT:QzHs2hW+AeJu+Kj1B2nmE9
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
Executes dropped EXE 4 IoCs
pid Process 1264 vm4xf49.exe 2724 jn5mm56.exe 2608 dd3kt90.exe 2984 1kb61fH6.exe -
Loads dropped DLL 12 IoCs
pid Process 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 1264 vm4xf49.exe 1264 vm4xf49.exe 2724 jn5mm56.exe 2724 jn5mm56.exe 2608 dd3kt90.exe 2608 dd3kt90.exe 2984 1kb61fH6.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" dd3kt90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vm4xf49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" jn5mm56.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2984 set thread context of 2920 2984 1kb61fH6.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2640 2984 WerFault.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2920 AppLaunch.exe 2920 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2920 AppLaunch.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 664 wrote to memory of 1264 664 NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe 28 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 1264 wrote to memory of 2724 1264 vm4xf49.exe 29 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2724 wrote to memory of 2608 2724 jn5mm56.exe 30 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2608 wrote to memory of 2984 2608 dd3kt90.exe 31 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2920 2984 1kb61fH6.exe 32 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33 PID 2984 wrote to memory of 2640 2984 1kb61fH6.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASe38cfe132158fb26de95b367811bca48d0c9ba22318bda33084363fa6e4637bcexeexeexe_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vm4xf49.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jn5mm56.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dd3kt90.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1kb61fH6.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2726⤵
- Loads dropped DLL
- Program crash
PID:2640
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD571c76e4535c31cb12fe199b9ffbb77c9
SHA1948f00e196721bb38d23570965a5a0f512aac50f
SHA256745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa
SHA512f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0
-
Filesize
1.3MB
MD571c76e4535c31cb12fe199b9ffbb77c9
SHA1948f00e196721bb38d23570965a5a0f512aac50f
SHA256745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa
SHA512f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0
-
Filesize
903KB
MD5b636c65de3a0502e881f15ddf3044a81
SHA1d051758765b18451e9731c811b6c32a5f6851e1f
SHA256fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d
SHA5125f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81
-
Filesize
903KB
MD5b636c65de3a0502e881f15ddf3044a81
SHA1d051758765b18451e9731c811b6c32a5f6851e1f
SHA256fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d
SHA5125f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81
-
Filesize
535KB
MD5f3f1453113dda755af93227e69e82c4e
SHA118ff0a684ddeb60a8fe9a63090bfae5642247672
SHA256bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84
SHA512514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3
-
Filesize
535KB
MD5f3f1453113dda755af93227e69e82c4e
SHA118ff0a684ddeb60a8fe9a63090bfae5642247672
SHA256bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84
SHA512514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
1.3MB
MD571c76e4535c31cb12fe199b9ffbb77c9
SHA1948f00e196721bb38d23570965a5a0f512aac50f
SHA256745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa
SHA512f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0
-
Filesize
1.3MB
MD571c76e4535c31cb12fe199b9ffbb77c9
SHA1948f00e196721bb38d23570965a5a0f512aac50f
SHA256745066bf93ac54a2326ad9e4f9bd731c9565c43926e3a12ef8cfe14da5d217fa
SHA512f412c40475ff8e0a5b365002a044a546f3497ae9c190a106dd6b611397f3ad87f5a334083f3c6b916d8b93585dc56b7caf7eca72b3fefe0a711488d0ea3254b0
-
Filesize
903KB
MD5b636c65de3a0502e881f15ddf3044a81
SHA1d051758765b18451e9731c811b6c32a5f6851e1f
SHA256fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d
SHA5125f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81
-
Filesize
903KB
MD5b636c65de3a0502e881f15ddf3044a81
SHA1d051758765b18451e9731c811b6c32a5f6851e1f
SHA256fc781c95fdbc27c5f6cb372b7d1e18bf38b60340faaf66ba0452c3d66e62690d
SHA5125f497a120144f68a144c4342f7cbfa509e4cfd6d2e6d42872b2097b866976ac29585bc6080f168966eec5856846f6584788d9c6d78e1c2e250f948c4e1353c81
-
Filesize
535KB
MD5f3f1453113dda755af93227e69e82c4e
SHA118ff0a684ddeb60a8fe9a63090bfae5642247672
SHA256bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84
SHA512514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3
-
Filesize
535KB
MD5f3f1453113dda755af93227e69e82c4e
SHA118ff0a684ddeb60a8fe9a63090bfae5642247672
SHA256bc65161ed68af64550b5eefb332c97747b1938044687e953a722b229a8b1af84
SHA512514a10ca66b1ba61a08f9fc0a456ba77d6577dd5b5c66c42de5c09c397fc79e433068f547c7b83821f6f7bcf7e295840f472942a5272a1e5667d8a9823f308b3
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81