Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    170s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 08:20

General

  • Target

    NEAS.e7c92559710c81b98c13caa39f08e9c0.exe

  • Size

    248KB

  • MD5

    e7c92559710c81b98c13caa39f08e9c0

  • SHA1

    5d81f47cc462dd1d117bc6ded76bc81e2674a833

  • SHA256

    20fac48ebd70399d520dd1239b2c3ba14d750310c14966cbd4903aafd4b3f2e9

  • SHA512

    20a05f9226cb5315ea86d4497233440ffd3ecd6822ec6ac71ea49bd4042f6dc1f4f108ac83652dbf6cd578ed3bb408c3cbec0fcfbb776825038e939c716fda7c

  • SSDEEP

    6144:anNVQ/yyUf9dP9LAVRKlqBiErIsKnPmb7/jWal+FfAje+5/RxoOsutOSD/uP39R/:anZyUf9oRKlqgErIsKnPmb7/jWa1e+5T

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.e7c92559710c81b98c13caa39f08e9c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.e7c92559710c81b98c13caa39f08e9c0.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\miona.exe
      "C:\Users\Admin\miona.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\miona.exe

    Filesize

    248KB

    MD5

    021138049f9c0b43edcd490f3fc04ddf

    SHA1

    012b70d7383e0a3668531e9db1cf0467787ee84b

    SHA256

    446d353eaeb73268c8e9bb05b0f70a09143a41de866b33790968581c5e00df2f

    SHA512

    374f9d371e87ca91f3f56b26ad48f6922d56e410bcaa67374ac51575de25c798c22c4a19a53805fc60216bb8d5211fd9123843e385c52d4a5f5011111d09e907

  • C:\Users\Admin\miona.exe

    Filesize

    248KB

    MD5

    021138049f9c0b43edcd490f3fc04ddf

    SHA1

    012b70d7383e0a3668531e9db1cf0467787ee84b

    SHA256

    446d353eaeb73268c8e9bb05b0f70a09143a41de866b33790968581c5e00df2f

    SHA512

    374f9d371e87ca91f3f56b26ad48f6922d56e410bcaa67374ac51575de25c798c22c4a19a53805fc60216bb8d5211fd9123843e385c52d4a5f5011111d09e907

  • C:\Users\Admin\miona.exe

    Filesize

    248KB

    MD5

    021138049f9c0b43edcd490f3fc04ddf

    SHA1

    012b70d7383e0a3668531e9db1cf0467787ee84b

    SHA256

    446d353eaeb73268c8e9bb05b0f70a09143a41de866b33790968581c5e00df2f

    SHA512

    374f9d371e87ca91f3f56b26ad48f6922d56e410bcaa67374ac51575de25c798c22c4a19a53805fc60216bb8d5211fd9123843e385c52d4a5f5011111d09e907

  • \Users\Admin\miona.exe

    Filesize

    248KB

    MD5

    021138049f9c0b43edcd490f3fc04ddf

    SHA1

    012b70d7383e0a3668531e9db1cf0467787ee84b

    SHA256

    446d353eaeb73268c8e9bb05b0f70a09143a41de866b33790968581c5e00df2f

    SHA512

    374f9d371e87ca91f3f56b26ad48f6922d56e410bcaa67374ac51575de25c798c22c4a19a53805fc60216bb8d5211fd9123843e385c52d4a5f5011111d09e907

  • \Users\Admin\miona.exe

    Filesize

    248KB

    MD5

    021138049f9c0b43edcd490f3fc04ddf

    SHA1

    012b70d7383e0a3668531e9db1cf0467787ee84b

    SHA256

    446d353eaeb73268c8e9bb05b0f70a09143a41de866b33790968581c5e00df2f

    SHA512

    374f9d371e87ca91f3f56b26ad48f6922d56e410bcaa67374ac51575de25c798c22c4a19a53805fc60216bb8d5211fd9123843e385c52d4a5f5011111d09e907