Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

NEAS.882b0...20.exe

windows7-x64

10

NEAS.882b0...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.882b0e3a6fa4f034d7b920a80fbf0c20.exe

  • Size

    2.6MB

  • Sample

    231016-w34v9ahd36

  • MD5

    882b0e3a6fa4f034d7b920a80fbf0c20

  • SHA1

    09700a62c0848d82096e257615fc340fa7f2768f

  • SHA256

    78a78d59eebe09d08b4851b830317fa46f06f9ad78290d44dcb1f28fe805be79

  • SHA512

    aa685817eb309e6ce39ba7a032c4ec3b00ad6cf32271d7c6eb0b1f37fb4db380317a633f9a746557173c36828718aefefa35ff508a8ef03c9ba43c2ac8caed3a

  • SSDEEP

    49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/u:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/u

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      NEAS.882b0e3a6fa4f034d7b920a80fbf0c20.exe

    • Size

      2.6MB

    • MD5

      882b0e3a6fa4f034d7b920a80fbf0c20

    • SHA1

      09700a62c0848d82096e257615fc340fa7f2768f

    • SHA256

      78a78d59eebe09d08b4851b830317fa46f06f9ad78290d44dcb1f28fe805be79

    • SHA512

      aa685817eb309e6ce39ba7a032c4ec3b00ad6cf32271d7c6eb0b1f37fb4db380317a633f9a746557173c36828718aefefa35ff508a8ef03c9ba43c2ac8caed3a

    • SSDEEP

      49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/u:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/u

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks