Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.4ea1a42d62bbcce91284af6179e470a0.exe
-
Size
135KB
-
MD5
4ea1a42d62bbcce91284af6179e470a0
-
SHA1
15bc5f47c736f13996b603c4c48803cf8dcc0c19
-
SHA256
45adf5ec60fc488c46bea8d719c14e8f7c12d343c2288bae8608d4db5a71faef
-
SHA512
176debb9aba1561ca8b067e25bfff3e83b984d0c53ab96b37e704d83f7c5e89c6c51e57cf3aabda290c620fc246ede86d532acad25bb329dd0701eb1ac172d86
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBXf:UVqoCl/YgjxEufVU0TbTyDDalnf
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 336 explorer.exe 3892 spoolsv.exe 4880 svchost.exe 4320 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe NEAS.4ea1a42d62bbcce91284af6179e470a0.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe 336 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 336 explorer.exe 4880 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 336 explorer.exe 336 explorer.exe 3892 spoolsv.exe 3892 spoolsv.exe 4880 svchost.exe 4880 svchost.exe 4320 spoolsv.exe 4320 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5088 wrote to memory of 336 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 86 PID 5088 wrote to memory of 336 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 86 PID 5088 wrote to memory of 336 5088 NEAS.4ea1a42d62bbcce91284af6179e470a0.exe 86 PID 336 wrote to memory of 3892 336 explorer.exe 87 PID 336 wrote to memory of 3892 336 explorer.exe 87 PID 336 wrote to memory of 3892 336 explorer.exe 87 PID 3892 wrote to memory of 4880 3892 spoolsv.exe 88 PID 3892 wrote to memory of 4880 3892 spoolsv.exe 88 PID 3892 wrote to memory of 4880 3892 spoolsv.exe 88 PID 4880 wrote to memory of 4320 4880 svchost.exe 89 PID 4880 wrote to memory of 4320 4880 svchost.exe 89 PID 4880 wrote to memory of 4320 4880 svchost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4ea1a42d62bbcce91284af6179e470a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4ea1a42d62bbcce91284af6179e470a0.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4320
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD52a948096bcd4602498b89dabb080cfc5
SHA1d2784bf2b066ebc5f0a2fc8f9492cdba1e6ad908
SHA256cc5a6cd02e668c90ce4fc359f34cac8cbdaa2aafe7fe793fea5b0a8b03ba1efd
SHA512c293c52a73b8cffd24b737dee9263f52721cbd49033d577e841ace964f9c435019744f9474c01b1fc63828e638d52e0a021ccd222e531dadf75a7b00e77d87a3
-
Filesize
135KB
MD5e116f7e98152c513ed6c221f38b5d00d
SHA138f50c8397dbf50bd3238f335aadcb72e914841f
SHA256efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152
SHA5124d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4
-
Filesize
135KB
MD5e116f7e98152c513ed6c221f38b5d00d
SHA138f50c8397dbf50bd3238f335aadcb72e914841f
SHA256efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152
SHA5124d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4
-
Filesize
135KB
MD5e116f7e98152c513ed6c221f38b5d00d
SHA138f50c8397dbf50bd3238f335aadcb72e914841f
SHA256efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152
SHA5124d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4
-
Filesize
135KB
MD540fc53c54f1af6c7d682575cecb6c2b6
SHA19b98f7efa63d1c15232eb7e899c9f2caa00fe8fb
SHA256900f7a39d8ea0a616a869224f9290e53bcf134ebdcb9051cccbe93f66dad8f41
SHA512d72642c778ceb6f374b1664174c28bea0980fc8d9c4167f99e1a7fd8fd18d99fc1e2d8cecce7de58247449f6cbcfa5d5c36e335d323165ac67729ef46e58a980
-
Filesize
135KB
MD5e116f7e98152c513ed6c221f38b5d00d
SHA138f50c8397dbf50bd3238f335aadcb72e914841f
SHA256efa187599f6deb54ca4cd740a374937731e82e06221590abb24e34e557838152
SHA5124d5b308c78e9cf0de322fd2f4f46cdc78c21a1f46b436e9ab45c9dbb44d973e31fd53171083eecb439e779e11c9adbce3eb713f7617c4d62dae8dc5c90bbddb4
-
Filesize
135KB
MD540fc53c54f1af6c7d682575cecb6c2b6
SHA19b98f7efa63d1c15232eb7e899c9f2caa00fe8fb
SHA256900f7a39d8ea0a616a869224f9290e53bcf134ebdcb9051cccbe93f66dad8f41
SHA512d72642c778ceb6f374b1664174c28bea0980fc8d9c4167f99e1a7fd8fd18d99fc1e2d8cecce7de58247449f6cbcfa5d5c36e335d323165ac67729ef46e58a980
-
Filesize
135KB
MD52a948096bcd4602498b89dabb080cfc5
SHA1d2784bf2b066ebc5f0a2fc8f9492cdba1e6ad908
SHA256cc5a6cd02e668c90ce4fc359f34cac8cbdaa2aafe7fe793fea5b0a8b03ba1efd
SHA512c293c52a73b8cffd24b737dee9263f52721cbd49033d577e841ace964f9c435019744f9474c01b1fc63828e638d52e0a021ccd222e531dadf75a7b00e77d87a3