Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 18:29
Behavioral task
behavioral1
Sample
NEAS.93977855e03dddef70cbf66b16c6be10.exe
Resource
win7-20230831-en
General
-
Target
NEAS.93977855e03dddef70cbf66b16c6be10.exe
-
Size
465KB
-
MD5
93977855e03dddef70cbf66b16c6be10
-
SHA1
6c30aaf76da7bd5be3120a41977300a6068e8a9d
-
SHA256
0b9a8a57f5f9b7a2bd41a12ddb854ee1b534c19f04ea83196682c2a85362ddaf
-
SHA512
0d185f45b996e6a641970235b4cfeaaa0f96d795db7f5a61785b75eb2d7ace80f14b942ef479f98b99b44eb093bc1b8c0187502735cc854af244c933a04a2b39
-
SSDEEP
6144:k9H4y9VOpL/DeRRoSGFPRuDYBzFrY5dRA2AkCMnZi6c/2AS9kFwJARejm7m:kZF9VOpnqoSG1EcBhs9xAkLZMomm
Malware Config
Extracted
urelas
121.88.5.183
218.54.30.235
Signatures
-
Deletes itself 1 IoCs
pid Process 1852 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2676 sander.exe -
Loads dropped DLL 1 IoCs
pid Process 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe -
resource yara_rule behavioral1/memory/3060-0-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral1/files/0x000d000000012276-8.dat upx behavioral1/files/0x000d000000012276-4.dat upx behavioral1/memory/3060-16-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral1/memory/2676-19-0x0000000000400000-0x00000000004A9000-memory.dmp upx behavioral1/memory/2676-20-0x0000000000400000-0x00000000004A9000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2676 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 28 PID 3060 wrote to memory of 2676 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 28 PID 3060 wrote to memory of 2676 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 28 PID 3060 wrote to memory of 2676 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 28 PID 3060 wrote to memory of 1852 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 29 PID 3060 wrote to memory of 1852 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 29 PID 3060 wrote to memory of 1852 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 29 PID 3060 wrote to memory of 1852 3060 NEAS.93977855e03dddef70cbf66b16c6be10.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.93977855e03dddef70cbf66b16c6be10.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\sander.exe"C:\Users\Admin\AppData\Local\Temp\sander.exe"2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\_sannuyex.bat" "2⤵
- Deletes itself
PID:1852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
287B
MD5076ff79aa57dc4c8c239c4e921e18bee
SHA144cd3009b8093b5e5889c23c6e49878958e9b83e
SHA2565f439ddd5f569aa13566f07dc643833fcce94e795bfa60d450e1aef3d66b32b4
SHA512956fa5df9309fc6cff5553b5c27176cbb3697ff647759e4f78ae80695a2412581c3925dc980cbff4cb650148ad4cf36c93f0411341307685a1f66b9c6d6e405c
-
Filesize
287B
MD5076ff79aa57dc4c8c239c4e921e18bee
SHA144cd3009b8093b5e5889c23c6e49878958e9b83e
SHA2565f439ddd5f569aa13566f07dc643833fcce94e795bfa60d450e1aef3d66b32b4
SHA512956fa5df9309fc6cff5553b5c27176cbb3697ff647759e4f78ae80695a2412581c3925dc980cbff4cb650148ad4cf36c93f0411341307685a1f66b9c6d6e405c
-
Filesize
512B
MD5178eba193b631d7b0653896453b678b2
SHA18878cae8fb5417248da5800e4d85b00149160404
SHA2568c7800dfaf639b17e6b682b6fa2365275e6f80d07e6aa6bb56b676669d0e9db5
SHA512936f9ec171c7ad5aa63c6691d9ea109a3f1ef31fe00bc26fe5afa8ae0ee21b5d3f65e873a242e7986f98bcb9abc82911dbf34bb907ed7a4973e959b7e90c69d5
-
Filesize
465KB
MD5b3f612a14f3e19494f86c666e3957d04
SHA18c749a83b0dfd6cae653bf8ddcf8892807459291
SHA256063053d70010fce1867f690bc160b9bde995cd0eab50eebc9992ad362b2a2c8a
SHA512b98690c99a61c1c573a61f79d5ce9149467f94f098212a2c039d149d572d75681b7f7646d4e3d33308ea3c7b96099fc04823c6defe45bf579a9a59d8fe2f0df2
-
Filesize
465KB
MD5b3f612a14f3e19494f86c666e3957d04
SHA18c749a83b0dfd6cae653bf8ddcf8892807459291
SHA256063053d70010fce1867f690bc160b9bde995cd0eab50eebc9992ad362b2a2c8a
SHA512b98690c99a61c1c573a61f79d5ce9149467f94f098212a2c039d149d572d75681b7f7646d4e3d33308ea3c7b96099fc04823c6defe45bf579a9a59d8fe2f0df2