Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6addf06d3376886553adcd3a084ed910.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.6addf06d3376886553adcd3a084ed910.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.6addf06d3376886553adcd3a084ed910.exe
-
Size
317KB
-
MD5
6addf06d3376886553adcd3a084ed910
-
SHA1
9daf15b01e1f01609963472e4e70b93a66c7b0d3
-
SHA256
79d44037a239950ca0b2bb8e58611b32233039cdb01369e0a1f81d12df69d7a3
-
SHA512
f4588fb888361ce3dff2ad928ae501dee3eef83d9c0fdbba7e389d4d20cbe1b1e968de67fdc2504339eb8c9c59aa57433358f4aa108bdd7b4517a007fc3944eb
-
SSDEEP
768:5BBdFYDgao5/AUrLEEzayTpBJfxBDlxkFNXK8D1Foji:5pcC/eAayJ3Rx8T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1968 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" NEAS.6addf06d3376886553adcd3a084ed910.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\¢«.exe NEAS.6addf06d3376886553adcd3a084ed910.exe File created C:\Windows\SysWOW64\notepad¢¬.exe NEAS.6addf06d3376886553adcd3a084ed910.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\system\rundll32.exe NEAS.6addf06d3376886553adcd3a084ed910.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command NEAS.6addf06d3376886553adcd3a084ed910.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1697346875" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "505" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" NEAS.6addf06d3376886553adcd3a084ed910.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1697346875" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 1968 rundll32.exe 1968 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29 PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29 PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29 PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29 PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29 PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29 PID 2224 wrote to memory of 1968 2224 NEAS.6addf06d3376886553adcd3a084ed910.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6addf06d3376886553adcd3a084ed910.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6addf06d3376886553adcd3a084ed910.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349KB
MD5f0caefcd53ae66a6ce360641301de7fd
SHA149e403fa1410fdfbd8cf45756f30faa5f1259e3b
SHA256b830b492e29d2ed8ea8832d398690f200a962431daf6ae6c624d6d03812427b6
SHA5122e08c9f1de211e7d5c8f29f586a82fd510d82aa0d0ba94a6db3df04cf93fa20814850c6a5efe3ae8cecc079480ffbddd7176b893cd6266a0ff873742d81de451
-
Filesize
349KB
MD5f0caefcd53ae66a6ce360641301de7fd
SHA149e403fa1410fdfbd8cf45756f30faa5f1259e3b
SHA256b830b492e29d2ed8ea8832d398690f200a962431daf6ae6c624d6d03812427b6
SHA5122e08c9f1de211e7d5c8f29f586a82fd510d82aa0d0ba94a6db3df04cf93fa20814850c6a5efe3ae8cecc079480ffbddd7176b893cd6266a0ff873742d81de451
-
Filesize
349KB
MD5f0caefcd53ae66a6ce360641301de7fd
SHA149e403fa1410fdfbd8cf45756f30faa5f1259e3b
SHA256b830b492e29d2ed8ea8832d398690f200a962431daf6ae6c624d6d03812427b6
SHA5122e08c9f1de211e7d5c8f29f586a82fd510d82aa0d0ba94a6db3df04cf93fa20814850c6a5efe3ae8cecc079480ffbddd7176b893cd6266a0ff873742d81de451
-
Filesize
349KB
MD5f0caefcd53ae66a6ce360641301de7fd
SHA149e403fa1410fdfbd8cf45756f30faa5f1259e3b
SHA256b830b492e29d2ed8ea8832d398690f200a962431daf6ae6c624d6d03812427b6
SHA5122e08c9f1de211e7d5c8f29f586a82fd510d82aa0d0ba94a6db3df04cf93fa20814850c6a5efe3ae8cecc079480ffbddd7176b893cd6266a0ff873742d81de451
-
Filesize
349KB
MD5f0caefcd53ae66a6ce360641301de7fd
SHA149e403fa1410fdfbd8cf45756f30faa5f1259e3b
SHA256b830b492e29d2ed8ea8832d398690f200a962431daf6ae6c624d6d03812427b6
SHA5122e08c9f1de211e7d5c8f29f586a82fd510d82aa0d0ba94a6db3df04cf93fa20814850c6a5efe3ae8cecc079480ffbddd7176b893cd6266a0ff873742d81de451