Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.9f991524577d98d836841c1d7764c7f0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.9f991524577d98d836841c1d7764c7f0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.9f991524577d98d836841c1d7764c7f0.exe
-
Size
5.6MB
-
MD5
9f991524577d98d836841c1d7764c7f0
-
SHA1
b183121295634cfce735621d9bbe0c293c9c415c
-
SHA256
6b6bbb31151d5d0e0b53fac6bfbd5c25cc9cb46d471c3893c0f56c62dd0a1470
-
SHA512
e0f9894cf88b33972cbed34f00f8461459af454d23621b9abfdfc1cfb372ba615edac9f2f86f12e5b1a964de78dcc066c1f9c78edfaeae2656ae038efd8ccc99
-
SSDEEP
98304:CzS3f1Tm1rfLNeT1gv50GDzdMuN75zKBV2C44:x3dC1rtddTOBG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Microsoft\Internet Explorer\TypedURLs NEAS.9f991524577d98d836841c1d7764c7f0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2080 NEAS.9f991524577d98d836841c1d7764c7f0.exe