Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    178s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 18:25

General

  • Target

    NEAS.761fb6beb885570604868cd0b7ea8db0.exe

  • Size

    308KB

  • MD5

    761fb6beb885570604868cd0b7ea8db0

  • SHA1

    ac0026aebae4a5d585493d184f00816c4c9c3012

  • SHA256

    2bb2207f736bedb5577c7c8d78b6fe5872621988482be858d1695bb6051d205f

  • SHA512

    06a13c7079b82129e7fa4487ebfaf466db559070737ade8bcb210dde247a27fd7c8c82d9cfc599a200b908553052da38d5536bcb1e88524c4b2a26431a54765c

  • SSDEEP

    6144:nTqEVgLEZgTIYU8ezXu5AZ1kG6+WNLABMQszusDBk1aXgJIrV:nTqEVgIZGU8QXuq4eMBusFqs

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.761fb6beb885570604868cd0b7ea8db0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.761fb6beb885570604868cd0b7ea8db0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\F0E8.tmp
      C:\Users\Admin\AppData\Local\Temp\F0E8.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\F0E8.tmp

    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

  • C:\Users\Admin\AppData\Local\Temp\F0E8.tmp

    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

  • memory/3732-0-0x00000000005E0000-0x0000000000618000-memory.dmp

    Filesize

    224KB

  • memory/3732-1-0x00000000005E0000-0x0000000000618000-memory.dmp

    Filesize

    224KB

  • memory/3732-3-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/3732-13-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB