Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 18:29
Behavioral task
behavioral1
Sample
NEAS.949019ade49da5e30314adfb89bf76d0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.949019ade49da5e30314adfb89bf76d0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.949019ade49da5e30314adfb89bf76d0.exe
-
Size
7.7MB
-
MD5
949019ade49da5e30314adfb89bf76d0
-
SHA1
3b8b14dfd3b2d5d724edb9e024b5ea877b0bb0e7
-
SHA256
bd7da98c72df227a2f88801cc15e298b6b822a5dcab0dab8c6a8f8789a1f8697
-
SHA512
e9d3df5b5dfaea9c1c8c2ec0cbe76041fced18960402f4e593405bca2cbfc36a20ba342b316bc25dc22941561244df83052a3b4eaf0bbfef2c8e8d40154b654c
-
SSDEEP
196608:ICMpb7KX/Rdl9eN4x+yAiWfkHpdohXlRy8iPyDWt:oYX5bm27QfApsRydUWt
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2952 NEAS.949019ade49da5e30314adfb89bf76d0.exe -
resource yara_rule behavioral1/files/0x0005000000018b6e-26.dat upx behavioral1/files/0x0005000000018b6e-27.dat upx behavioral1/memory/2952-28-0x000007FEF6370000-0x000007FEF67DF000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2952 1808 NEAS.949019ade49da5e30314adfb89bf76d0.exe 28 PID 1808 wrote to memory of 2952 1808 NEAS.949019ade49da5e30314adfb89bf76d0.exe 28 PID 1808 wrote to memory of 2952 1808 NEAS.949019ade49da5e30314adfb89bf76d0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe"2⤵
- Loads dropped DLL
PID:2952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d366db026edf7875a5e3d0cf42808148
SHA1fc60d2581c4cdb4f240d8769dc5154b1f48e616d
SHA2566d70ac2367a5794aea069883c12261694755b79454337afbce4f672930652d7f
SHA512479397f006cc943b61c11e229e22433fc2e0b3446359d0ea7f7b8882f953a1f1453920ccf6a674b1f076af316562573825cff33c23d6e7e0abc142b832377153
-
Filesize
1.5MB
MD5d366db026edf7875a5e3d0cf42808148
SHA1fc60d2581c4cdb4f240d8769dc5154b1f48e616d
SHA2566d70ac2367a5794aea069883c12261694755b79454337afbce4f672930652d7f
SHA512479397f006cc943b61c11e229e22433fc2e0b3446359d0ea7f7b8882f953a1f1453920ccf6a674b1f076af316562573825cff33c23d6e7e0abc142b832377153