Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.aa2353c29dd63a1f7b873929baff9690.exe
-
Size
441KB
-
Sample
231014-wrmgtsgb35
-
MD5
aa2353c29dd63a1f7b873929baff9690
-
SHA1
28e69e15df7f0a03cc91222f0377449d50131a72
-
SHA256
bf47a9013b280af8b576de1276c15f0f25f82c5af0076d6ff758ec3c7690cb5d
-
SHA512
c9997c5428e4938611740a72d2343f9398f89976297c9fcc4e506c76a429d35064b9a8feab3fdc188547caac84e17bad55df86755019e1df1253be41feda057b
-
SSDEEP
6144:/pW2bgbbV28okoS1oWMkdlZQ5iioc+nBkl7x87t6Qq3AClQZy:/pW2IoioS6D/OZy
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.aa2353c29dd63a1f7b873929baff9690.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.aa2353c29dd63a1f7b873929baff9690.exe
Resource
win10v2004-20230915-en
Malware Config
Targets
-
-
Target
NEAS.aa2353c29dd63a1f7b873929baff9690.exe
-
Size
441KB
-
MD5
aa2353c29dd63a1f7b873929baff9690
-
SHA1
28e69e15df7f0a03cc91222f0377449d50131a72
-
SHA256
bf47a9013b280af8b576de1276c15f0f25f82c5af0076d6ff758ec3c7690cb5d
-
SHA512
c9997c5428e4938611740a72d2343f9398f89976297c9fcc4e506c76a429d35064b9a8feab3fdc188547caac84e17bad55df86755019e1df1253be41feda057b
-
SSDEEP
6144:/pW2bgbbV28okoS1oWMkdlZQ5iioc+nBkl7x87t6Qq3AClQZy:/pW2IoioS6D/OZy
Score10/10-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Modifies file permissions
-
Modifies system executable filetype association
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Event Triggered Execution
1Change Default File Association
1