Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
14/10/2023, 18:04 UTC
General
-
Target
NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe
-
Size
346KB
-
MD5
87e7d4cb4a0d4e2523e03bc159bef7d0
-
SHA1
357d1149fe49928e2868238b8cf9598c557a5a7b
-
SHA256
75161078d75acead13d1a4236df271476c17a7be656cbc536a996cdddc69db5c
-
SHA512
23279a35049fa7a4dea72f1de343a42f599d0a9e1d02d475548dd8f53aa5ac77ec890d60596b958215150bd080632ece4bef9fe3bde0b546dad5b1d3d2079a55
-
SSDEEP
6144:8uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+W:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4W
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.87e7d4cb4a0d4e2523e03bc159bef7d0.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse -
DNS9.228.82.20.in-addr.arpaRemote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
DNS126.24.238.8.in-addr.arpaRemote address:8.8.8.8:53Request126.24.238.8.in-addr.arpaIN PTRResponse
-
DNS59.128.231.4.in-addr.arpaRemote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
DNS39.142.81.104.in-addr.arpaRemote address:8.8.8.8:53Request39.142.81.104.in-addr.arpaIN PTRResponse39.142.81.104.in-addr.arpaIN PTRa104-81-142-39deploystaticakamaitechnologiescom
-
DNS205.47.74.20.in-addr.arpaRemote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
DNS157.123.68.40.in-addr.arpaRemote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS126.179.238.8.in-addr.arpaRemote address:8.8.8.8:53Request126.179.238.8.in-addr.arpaIN PTRResponse
-
DNS208.194.73.20.in-addr.arpaRemote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
DNS158.240.127.40.in-addr.arpaRemote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse
-
DNS8.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request8.173.189.20.in-addr.arpaIN PTRResponse
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:539.228.82.20.in-addr.arpadns
DNS Request
9.228.82.20.in-addr.arpa
-
8.8.8.8:53126.24.238.8.in-addr.arpadns
DNS Request
126.24.238.8.in-addr.arpa
-
8.8.8.8:5359.128.231.4.in-addr.arpadns
DNS Request
59.128.231.4.in-addr.arpa
-
8.8.8.8:5339.142.81.104.in-addr.arpadns
DNS Request
39.142.81.104.in-addr.arpa
-
8.8.8.8:53205.47.74.20.in-addr.arpadns
DNS Request
205.47.74.20.in-addr.arpa
-
8.8.8.8:53157.123.68.40.in-addr.arpadns
DNS Request
157.123.68.40.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:53126.179.238.8.in-addr.arpadns
DNS Request
126.179.238.8.in-addr.arpa
-
8.8.8.8:53208.194.73.20.in-addr.arpadns
DNS Request
208.194.73.20.in-addr.arpa
-
8.8.8.8:53158.240.127.40.in-addr.arpadns
DNS Request
158.240.127.40.in-addr.arpa
-
8.8.8.8:538.173.189.20.in-addr.arpadns
DNS Request
8.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
346KB
MD5367d0ccf543247cffe148b9a3b145575
SHA13fcf0b4edb4e663f7630e02c2d24d54ab054bc55
SHA256c92d5ddf0395a95833b52d0542a9ce768b0cfef8f2ac851f84bed4735e7e5718
SHA5121ec9d7f35797803f937bcbd6b8307970fa2e1221a5609e92436e50861637bf6df2d6d90f74a6ebd85a329f3ffbaf4d601a7e9a6b3a53ca6b8edf53b1da862eea
-
Filesize
346KB
MD5367d0ccf543247cffe148b9a3b145575
SHA13fcf0b4edb4e663f7630e02c2d24d54ab054bc55
SHA256c92d5ddf0395a95833b52d0542a9ce768b0cfef8f2ac851f84bed4735e7e5718
SHA5121ec9d7f35797803f937bcbd6b8307970fa2e1221a5609e92436e50861637bf6df2d6d90f74a6ebd85a329f3ffbaf4d601a7e9a6b3a53ca6b8edf53b1da862eea
-
Filesize
346KB
MD5e90e88ef8c53a4177011cab554f31e18
SHA1c38d6ea172011add51953c77303d5029b47d19b0
SHA256a33d8a383d59d4e1efba65f2fd59250384f9503d8cc2678c76f50f89aaae505d
SHA5127c794f7b1f43d0e0833729a68507269b2544a4fa8e46f899a6e3b37b2cb6fa44253b42869172db023196766091f52420b105a6b40f0898bb26f2b0665f67eb1d
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB