Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    172s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2023, 17:51

General

  • Target

    NEAS.3b77273f1985a8710101463bc31f08f0.exe

  • Size

    521KB

  • MD5

    3b77273f1985a8710101463bc31f08f0

  • SHA1

    22f4a0ce68de994ce60a7678120afa5fbc7178cb

  • SHA256

    2133c8856b82820bc001cebc7f16f3359ecf0bb688aed7dff1c30bcc3bd396af

  • SHA512

    acea60c499f75027ec3a4de330cb05c9e09acd871969b9a5e6ad363448d8efc8b22272392c288291cabbbb7323cdc6e9466b2403fe3386f011e2bade024e83af

  • SSDEEP

    12288:urMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9V6DAR:EZyCA8CBmn+RrNj9ay5In

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.3b77273f1985a8710101463bc31f08f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.3b77273f1985a8710101463bc31f08f0.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\gOfficeC2RClient.ico

    Filesize

    4KB

    MD5

    3ea9bcbc01e1a652de5a6fc291a66d1a

    SHA1

    aee490d53ee201879dff37503a0796c77642a792

    SHA256

    a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c

    SHA512

    7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501

  • C:\Program Files\Java\jdk1.8.0_66\bin\gjavaws.ico

    Filesize

    4KB

    MD5

    38b41d03e9dfcbbd08210c5f0b50ba71

    SHA1

    2fbfde75ce9fe8423d8e7720bf7408cedcb57a70

    SHA256

    611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5

    SHA512

    ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9

  • C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\gmisc.ico

    Filesize

    4KB

    MD5

    fc27f73816c9f640d800cdc1c9294751

    SHA1

    e6c3d8835d1de4e9606e5588e741cd1be27398f6

    SHA256

    3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05

    SHA512

    9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4

  • C:\odt\office2016setup.exe

    Filesize

    521KB

    MD5

    3b77273f1985a8710101463bc31f08f0

    SHA1

    22f4a0ce68de994ce60a7678120afa5fbc7178cb

    SHA256

    2133c8856b82820bc001cebc7f16f3359ecf0bb688aed7dff1c30bcc3bd396af

    SHA512

    acea60c499f75027ec3a4de330cb05c9e09acd871969b9a5e6ad363448d8efc8b22272392c288291cabbbb7323cdc6e9466b2403fe3386f011e2bade024e83af

  • memory/4868-0-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/4868-1-0x00000000006A0000-0x00000000006A1000-memory.dmp

    Filesize

    4KB

  • memory/4868-169-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/4868-171-0x00000000006A0000-0x00000000006A1000-memory.dmp

    Filesize

    4KB

  • memory/4868-278-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB