Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    163s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 18:49

General

  • Target

    NEAS.NEASa9ee5717f9ed4aa52358a2dce5cd24e6exe_JC.exe

  • Size

    392KB

  • MD5

    a9ee5717f9ed4aa52358a2dce5cd24e6

  • SHA1

    fb07be112019076233e0012986e97738c06b9ea4

  • SHA256

    984d9cf4b34ed3602c3773af5aa6634f0fde8f5014412ff69064f40b53ca86e4

  • SHA512

    ace8009bb0a17385a51ec52e83f72edb1551a29a7c76c9c921d1e05ad75315318d66becf96111d4cc6ac12e78caa9090a05b3a416fcbd5ea3badeb9565ba75ab

  • SSDEEP

    12288:fEOZQtZVa6JdD/lHoOMzXCGOoIVdDHMxj:fE1HVa2dDNIrrCGOoQDAj

Score
10/10

Malware Config

Signatures

  • Urelas

    Urelas is a trojan targeting card games.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASa9ee5717f9ed4aa52358a2dce5cd24e6exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASa9ee5717f9ed4aa52358a2dce5cd24e6exe_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\aproy.exe
      "C:\Users\Admin\AppData\Local\Temp\aproy.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Users\Admin\AppData\Local\Temp\mihec.exe
        "C:\Users\Admin\AppData\Local\Temp\mihec.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2344
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "
      2⤵
      • Deletes itself
      PID:2964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

    Filesize

    307B

    MD5

    70f5f3d86a52653f179a833e5cc41241

    SHA1

    ba76332fc40e2ba4e0d3baba6be290249d4fdd64

    SHA256

    fcebea282d9e05680c0864aafaa294bd31bfd3fe6e1bee3462169cdc922dcd40

    SHA512

    065ec402443442d969e6d67e19e60d8a0b9a1529cc926c8b54a1754b6098d785c4645e75dbb0578218c4bc5346bf1b126bb96419e962bad1b3c03fdae8273eab

  • C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat

    Filesize

    307B

    MD5

    70f5f3d86a52653f179a833e5cc41241

    SHA1

    ba76332fc40e2ba4e0d3baba6be290249d4fdd64

    SHA256

    fcebea282d9e05680c0864aafaa294bd31bfd3fe6e1bee3462169cdc922dcd40

    SHA512

    065ec402443442d969e6d67e19e60d8a0b9a1529cc926c8b54a1754b6098d785c4645e75dbb0578218c4bc5346bf1b126bb96419e962bad1b3c03fdae8273eab

  • C:\Users\Admin\AppData\Local\Temp\aproy.exe

    Filesize

    392KB

    MD5

    916df2b6f8b324d0408b239e593c31c0

    SHA1

    fd9ef6039693b628c426916624f507152fcfd894

    SHA256

    774b238cb362b79c71a5f63e65d62034be5cd5d1903c7ffb4482af2499e101fd

    SHA512

    54dfa171bf1914a627f5cb3f631a00fa4276beced34418c4b4841c1ccd738f5ff5098d53650b0151b42aff255589c91244d79ba79617d9d9bb3b906f59948659

  • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

    Filesize

    512B

    MD5

    0afc79ae2b5f5b955195a4405f5b52fc

    SHA1

    a4d45be7c2f27795f01bc6408fc1754721fa4391

    SHA256

    91157df7ce0446b4fecb45391e4f0be69f1f6521e4faba9aea2506e0a81c0247

    SHA512

    3460b3c273f5e4acaeee76b3ca986fef434bb259a9243e77bc3f19d1ebd2937cb3d2fc997a8ab776cfc45bb08ca9ed5ce59327f4009fc13ba91caf234d3e8b70

  • C:\Users\Admin\AppData\Local\Temp\mihec.exe

    Filesize

    182KB

    MD5

    bc6657925ea916dd1b71e0d66a67dc71

    SHA1

    1da94f6866a55bff89731c2a6dad9180d6095ca1

    SHA256

    2e5a1ee706e44f670872395c03697715be86105796e707044cfce542dcb7700a

    SHA512

    c7fb2c82d939615938b35d7b6d4064bbbfbc27aae9d28de7e832d64e98563ca76ebfd407e41cd55111562e274e167ff4f12d06fd95559bf706347732f3fca2df

  • \Users\Admin\AppData\Local\Temp\aproy.exe

    Filesize

    392KB

    MD5

    916df2b6f8b324d0408b239e593c31c0

    SHA1

    fd9ef6039693b628c426916624f507152fcfd894

    SHA256

    774b238cb362b79c71a5f63e65d62034be5cd5d1903c7ffb4482af2499e101fd

    SHA512

    54dfa171bf1914a627f5cb3f631a00fa4276beced34418c4b4841c1ccd738f5ff5098d53650b0151b42aff255589c91244d79ba79617d9d9bb3b906f59948659

  • \Users\Admin\AppData\Local\Temp\mihec.exe

    Filesize

    182KB

    MD5

    bc6657925ea916dd1b71e0d66a67dc71

    SHA1

    1da94f6866a55bff89731c2a6dad9180d6095ca1

    SHA256

    2e5a1ee706e44f670872395c03697715be86105796e707044cfce542dcb7700a

    SHA512

    c7fb2c82d939615938b35d7b6d4064bbbfbc27aae9d28de7e832d64e98563ca76ebfd407e41cd55111562e274e167ff4f12d06fd95559bf706347732f3fca2df

  • memory/1100-0-0x0000000000A10000-0x0000000000A75000-memory.dmp

    Filesize

    404KB

  • memory/1100-6-0x00000000022F0000-0x0000000002355000-memory.dmp

    Filesize

    404KB

  • memory/1100-18-0x0000000000A10000-0x0000000000A75000-memory.dmp

    Filesize

    404KB

  • memory/2080-27-0x00000000001B0000-0x0000000000215000-memory.dmp

    Filesize

    404KB

  • memory/2080-10-0x00000000001B0000-0x0000000000215000-memory.dmp

    Filesize

    404KB

  • memory/2080-26-0x0000000003020000-0x00000000030B7000-memory.dmp

    Filesize

    604KB

  • memory/2344-30-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-32-0x00000000000D0000-0x00000000000D2000-memory.dmp

    Filesize

    8KB

  • memory/2344-34-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-35-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-36-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-37-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-38-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-39-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-40-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB

  • memory/2344-41-0x0000000000E10000-0x0000000000EA7000-memory.dmp

    Filesize

    604KB