Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
171s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.44ff027e08c15905795fb591d5637710.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.44ff027e08c15905795fb591d5637710.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.44ff027e08c15905795fb591d5637710.exe
-
Size
987KB
-
MD5
44ff027e08c15905795fb591d5637710
-
SHA1
b398412f20ca525608a538b9809bb4aed313f2ab
-
SHA256
ca14fe361d17217965a7ec1ebcf2c930e52fd6f0f390f9494a24e4f26c454a72
-
SHA512
d892a6c17749075d65aa04d9e79010c2149f2bee639527584657c1e866e1b9a8da58fca890f0f4ffa471cf0264d05bbbe257c7b7713cb3bd48783b12c7733163
-
SSDEEP
12288:zaWzgMg7v3qnCiMErQohh0F4CCJ8lnyFQUvPh9gE4jL7gHa7JRvf2Eg8A2zoVRAj:2aHMv6CorjqnyFQSgE94K2kyJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe 2584 NEAS.44ff027e08c15905795fb591d5637710.exe