Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 13:49

General

  • Target

    NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe

  • Size

    234KB

  • MD5

    1a29fab2f570c8e8d5b68a7dde2a2c50

  • SHA1

    dce2498a6927035821e931f6844a6eff8b632dca

  • SHA256

    1ac1779dde2d8758ebc39a33924a9793deed23776b8362bbb4105217c0350244

  • SHA512

    d21dd985a50b7745213a33914f2e211ebb1748793dd1a5861d7bf59f35c7314201c3eaac6180530890465fc92ee5ec73e932cc02b19a2e6a9625f0e3b362ea8b

  • SSDEEP

    3072:n19h8n2k+45CB3u07TIQIpmeCB3KxA1z+gYitApnirdt435OgkrePTt:Dc35F48cei+TKiirdt47T

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe
      "C:\Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe" -launcher
      2⤵
      • Executes dropped EXE
      PID:2680
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe--.doc"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2056

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\NEAS.1a29fab2f570c8e8d5b68a7dde2a2c50_JC.exe--.doc

      Filesize

      86KB

      MD5

      42bb84cd743a039f3ccb077451d76cde

      SHA1

      c66ce85d73cb833806cfad0f418fb5e96a394ff2

      SHA256

      41f47e67d7ac6fed3c52a421b4b99436fa867f2b88567aeac88b8781bcff2c93

      SHA512

      f156f9e8db777a916bd77879bb670fa5f5c67b2c97261130173165e089467d779c7d980fab29fd8d79b5c5b11287cafe3ce8f8294832baf4dcb7230710211519

    • C:\Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe

      Filesize

      148KB

      MD5

      baf188290c6961f72c5d4eb07cd8b2ad

      SHA1

      15896679b4e7b4f1e02973a7fd3eadc399935d27

      SHA256

      3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

      SHA512

      d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

    • C:\Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe

      Filesize

      148KB

      MD5

      baf188290c6961f72c5d4eb07cd8b2ad

      SHA1

      15896679b4e7b4f1e02973a7fd3eadc399935d27

      SHA256

      3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

      SHA512

      d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

    • C:\Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe

      Filesize

      148KB

      MD5

      baf188290c6961f72c5d4eb07cd8b2ad

      SHA1

      15896679b4e7b4f1e02973a7fd3eadc399935d27

      SHA256

      3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

      SHA512

      d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

    • C:\Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe.lnk

      Filesize

      792B

      MD5

      625aadbd1388480177e3da80b7ecf455

      SHA1

      89058d32221ee1eafd2fa10588a97e30fe8a16c0

      SHA256

      6ede81ff77f0442e1353c0dda26ec9cd6a192e81b7a91ec4fcf7558ea2c6ac45

      SHA512

      9c15f3518efac80a34288f0974204b4f0b000025adb313dfc427a86759e6010bc7a78be18b8212e48fe30204aee99c33799e444ffb83a7ab333b5e33a6b7a437

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      8fd5066642a199cc9282c97e3b99d0b7

      SHA1

      5d793fef638b0b9c40bc20354c87ac5818f37b57

      SHA256

      9a263f54622c9908f11496d2892d869ebafac22648384fc838686ad51b9abf06

      SHA512

      584261b09548ee725862209cf1bdd5de21f492de755ffefeb12a3f729e929704b81ac86500f5d00c6a24c97840f75792438b0673a6632d117a142b7b2460c6b2

    • \Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe

      Filesize

      148KB

      MD5

      baf188290c6961f72c5d4eb07cd8b2ad

      SHA1

      15896679b4e7b4f1e02973a7fd3eadc399935d27

      SHA256

      3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

      SHA512

      d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

    • \Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe

      Filesize

      148KB

      MD5

      baf188290c6961f72c5d4eb07cd8b2ad

      SHA1

      15896679b4e7b4f1e02973a7fd3eadc399935d27

      SHA256

      3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

      SHA512

      d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

    • \Users\Admin\AppData\Roaming\JUBU8H\59DYBN.exe

      Filesize

      148KB

      MD5

      baf188290c6961f72c5d4eb07cd8b2ad

      SHA1

      15896679b4e7b4f1e02973a7fd3eadc399935d27

      SHA256

      3f4f21fb102d6bfa0a700b5a95fbe4b0d85d189e24e193d7da4dfb5adaa9c8fe

      SHA512

      d17585f44106b4ab3a02ea4b8790ca7145063f9b7a235a39802fc93165ed64922e9bc009c9134ddcae83462476b5afab7395c9d3a5027d6a75cc554a2836b7c4

    • memory/2036-47-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/2036-49-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/2680-35-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/2796-38-0x0000000071AAD000-0x0000000071AB8000-memory.dmp

      Filesize

      44KB

    • memory/2796-37-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2796-36-0x000000002F051000-0x000000002F052000-memory.dmp

      Filesize

      4KB

    • memory/2796-48-0x0000000071AAD000-0x0000000071AB8000-memory.dmp

      Filesize

      44KB

    • memory/2796-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2796-70-0x0000000071AAD000-0x0000000071AB8000-memory.dmp

      Filesize

      44KB