Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.157f4dd280bac25d91450ddd086f95c0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.157f4dd280bac25d91450ddd086f95c0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.157f4dd280bac25d91450ddd086f95c0.exe
-
Size
987KB
-
MD5
157f4dd280bac25d91450ddd086f95c0
-
SHA1
def98872972513a04e01ad912f3f77ebe7bf2760
-
SHA256
020362fe1e0b1bb14d7858e7290cf2b8c69602933921e49ffb684fdd9340e928
-
SHA512
f35347bf457390f459e6edd4b09342c7fec133aececef35b9e5e98cbba19ead5ff7f51e356d9af30014177e720ccf221488e121a24c1c9fe1d85ea1dbf63748a
-
SSDEEP
24576:/1/aGLDCM4D8ay0MZo8//PT2N0K+bcpUBkGjc3JnBrzRV:wD8ay0MZoQPT2N0K+bcpUBkVND
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2756 peoqhn.exe -
Loads dropped DLL 2 IoCs
pid Process 2252 NEAS.157f4dd280bac25d91450ddd086f95c0.exe 2252 NEAS.157f4dd280bac25d91450ddd086f95c0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\peoqhn.exe" peoqhn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2756 2252 NEAS.157f4dd280bac25d91450ddd086f95c0.exe 29 PID 2252 wrote to memory of 2756 2252 NEAS.157f4dd280bac25d91450ddd086f95c0.exe 29 PID 2252 wrote to memory of 2756 2252 NEAS.157f4dd280bac25d91450ddd086f95c0.exe 29 PID 2252 wrote to memory of 2756 2252 NEAS.157f4dd280bac25d91450ddd086f95c0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.157f4dd280bac25d91450ddd086f95c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.157f4dd280bac25d91450ddd086f95c0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\ProgramData\peoqhn.exe"C:\ProgramData\peoqhn.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
987KB
MD5df80440cc96b572c747552e1e2db36bd
SHA1d9df4137d2f22d8ba5c696bb99394de9a48df526
SHA256c5036f6499f40881bb7af40605253c32b61fab1a1be06a6a62a9d947850eef54
SHA512ccebb4b4f955671666b1416132ce2fcbaddc357211887147e8a5444e3ebc7c9b56f0624919df5730bcfae77a470cb675c266a733bf524d35515b6fa663c487bf
-
Filesize
477KB
MD50097732504850319971faed87f071fd4
SHA16f8bf40487719d18c54c85329ffc0346163e43db
SHA25696e2cebea72e7205b4b0b53d67606ccbedd4e9eb34d852bed65bc89063541a48
SHA51272af1a7e94544cb2b4a198713280823337a4cf4a7266320947a5b81ce4c41099c251ab86d94f753506328ad7750d3a0135d27af0ff5cf2147d01f3147d4448a7
-
Filesize
509KB
MD5190203c0ed5c49f712b3bfa863cecd6b
SHA132fc7cd8a95a338139c48b2fac545627d60c1395
SHA256e79e567d10676b5ada9470ff6b993c3392f0d4bfefe2441815d4e23c05ae175f
SHA512dec61dfaf04260aad14809858db52e81360041464efd81a160ef1ab6339c2c3b66494c31bfe41420f1b33db9a8cb5b2e51a653e4c8709781fe99785934d78226
-
Filesize
509KB
MD5190203c0ed5c49f712b3bfa863cecd6b
SHA132fc7cd8a95a338139c48b2fac545627d60c1395
SHA256e79e567d10676b5ada9470ff6b993c3392f0d4bfefe2441815d4e23c05ae175f
SHA512dec61dfaf04260aad14809858db52e81360041464efd81a160ef1ab6339c2c3b66494c31bfe41420f1b33db9a8cb5b2e51a653e4c8709781fe99785934d78226
-
Filesize
509KB
MD5190203c0ed5c49f712b3bfa863cecd6b
SHA132fc7cd8a95a338139c48b2fac545627d60c1395
SHA256e79e567d10676b5ada9470ff6b993c3392f0d4bfefe2441815d4e23c05ae175f
SHA512dec61dfaf04260aad14809858db52e81360041464efd81a160ef1ab6339c2c3b66494c31bfe41420f1b33db9a8cb5b2e51a653e4c8709781fe99785934d78226
-
Filesize
509KB
MD5190203c0ed5c49f712b3bfa863cecd6b
SHA132fc7cd8a95a338139c48b2fac545627d60c1395
SHA256e79e567d10676b5ada9470ff6b993c3392f0d4bfefe2441815d4e23c05ae175f
SHA512dec61dfaf04260aad14809858db52e81360041464efd81a160ef1ab6339c2c3b66494c31bfe41420f1b33db9a8cb5b2e51a653e4c8709781fe99785934d78226
-
Filesize
509KB
MD5190203c0ed5c49f712b3bfa863cecd6b
SHA132fc7cd8a95a338139c48b2fac545627d60c1395
SHA256e79e567d10676b5ada9470ff6b993c3392f0d4bfefe2441815d4e23c05ae175f
SHA512dec61dfaf04260aad14809858db52e81360041464efd81a160ef1ab6339c2c3b66494c31bfe41420f1b33db9a8cb5b2e51a653e4c8709781fe99785934d78226