Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 19:11
Behavioral task
behavioral1
Sample
NEAS.bfc34b8b4abb9add711fb9569abd3540.exe
Resource
win7-20230831-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.bfc34b8b4abb9add711fb9569abd3540.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
NEAS.bfc34b8b4abb9add711fb9569abd3540.exe
-
Size
34KB
-
MD5
bfc34b8b4abb9add711fb9569abd3540
-
SHA1
dbbd1dad1fcfb13df3b4555bab09c208c1c38e79
-
SHA256
3335638173a14b3a0c79c4f4b7f4974f974b8c4eeeb6dacaf2d7ac13e9f9d33c
-
SHA512
3049c1e23f539ee1e736bbf993207857d57a3a238d0c6ffa5b85a9879368e37ab59b58d1e902ddb8df5f33b01bc450bfebb2bb152fc4d4216cf9b09464bc7980
-
SSDEEP
768:SCIqdH/k1ZVcT194jp4uVRekWEc8W48eUvVWNFK4dm:SNqaLV8a6yRemcH6U9Wbzm
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3204-0-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-3-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-5-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-7-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-9-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/files/0x000d00000001d9f3-14.dat upx behavioral2/memory/3204-53-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-116-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-117-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-118-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-162-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3204-219-0x0000000000800000-0x000000000080D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" NEAS.bfc34b8b4abb9add711fb9569abd3540.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Kazaa Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\WinRAR.v.3.2.and.key.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\Harry Potter.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\WinRAR.v.3.2.and.key.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\WinRAR.v.3.2.and.key.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\Kazaa Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\WinRAR.v.3.2.and.key.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\Harry Potter.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\Kazaa Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\Winamp 5.0 (en) Crack.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\Winamp 5.0 (en).ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\Kazaa Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\Winamp 5.0 (en).ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\index.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\WinRAR.v.3.2.and.key.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\WinRAR.v.3.2.and.key.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\VGX\Winamp 5.0 (en).ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\Winamp 5.0 (en) Crack.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\index.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\index.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\Harry Potter.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\Winamp 5.0 (en).exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\WinRAR.v.3.2.and.key.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\Winamp 5.0 (en) Crack.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\Winamp 5.0 (en).exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\WinRAR.v.3.2.and.key.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\Kazaa Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\Kazaa Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\WinRAR.v.3.2.and.key.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\Winamp 5.0 (en) Crack.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\ICQ 4 Lite.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\ICQ 4 Lite.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\ICQ 4 Lite.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\ICQ 4 Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\index.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\index.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\Kazaa Lite.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\Harry Potter.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\index.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\index.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\Harry Potter.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\Winamp 5.0 (en) Crack.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\Winamp 5.0 (en) Crack.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\Harry Potter.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\WinRAR.v.3.2.and.key.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\ICQ 4 Lite.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\Winamp 5.0 (en) Crack.ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Harry Potter.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\WinRAR.v.3.2.and.key.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\WinRAR.v.3.2.and.key.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\Kazaa Lite.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\index.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\ICQ 4 Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\Winamp 5.0 (en).com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\Winamp 5.0 (en).ShareReactor.com NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\ICQ 4 Lite.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\Winamp 5.0 (en).exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\lsass.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe File opened for modification C:\Windows\lsass.exe NEAS.bfc34b8b4abb9add711fb9569abd3540.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD54d1665d3ced25f48fa44ba6a536ca15f
SHA13c4fc535a80569a59db06e38d01a45792fe66b53
SHA2569ff6d74dacdb4e6bd596f075f34d06159b31243b1dc60055d17ac40791f4da64
SHA512795c1ba42a9e5c31515aee933f64cd334a36e0b9f646537a0cf325d2dacdc50eaf5e9383b30b2e0fb7f3c53c7da91e2860187ce5ac3376c4ec8fa73176498b25