Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 20:39
Behavioral task
behavioral1
Sample
NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe
-
Size
7.9MB
-
MD5
c60c5dffa371c7e41fff7d8388a95da0
-
SHA1
791029587b7a998634adcbc6e3a5c7e37fe66adb
-
SHA256
9b0ad3f2b8a78a14542a531b7618caf357c67653edf964fc21b0987b95dc3470
-
SHA512
7b185b5ee3ff5856f0221240dbd4c1e5e2e07d22d3e92491adb2e30ab03c6e13daf4c7b907cfdacb21bbf7345a3e3e38ed81e797dd280c4ca72c651fbc64e531
-
SSDEEP
196608:1AaIis50mr2puHUHNTVxbAQAtwq+ZkiKDIjx0vjXAQYj+b:LsKmr2pu0tTVxAaq+ZkF0x0TAr
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2716 NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2716 1884 NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe 28 PID 1884 wrote to memory of 2716 1884 NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe 28 PID 1884 wrote to memory of 2716 1884 NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c60c5dffa371c7e41fff7d8388a95da0.exe"2⤵
- Loads dropped DLL
PID:2716
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5e4533934b37e688106beac6c5919281e
SHA1ada39f10ef0bbdcf05822f4260e43d53367b0017
SHA2562bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5
SHA512fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9
-
Filesize
4.3MB
MD5e4533934b37e688106beac6c5919281e
SHA1ada39f10ef0bbdcf05822f4260e43d53367b0017
SHA2562bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5
SHA512fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9