Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2023, 18:29

General

  • Target

    NEAS.949019ade49da5e30314adfb89bf76d0.exe

  • Size

    7.7MB

  • MD5

    949019ade49da5e30314adfb89bf76d0

  • SHA1

    3b8b14dfd3b2d5d724edb9e024b5ea877b0bb0e7

  • SHA256

    bd7da98c72df227a2f88801cc15e298b6b822a5dcab0dab8c6a8f8789a1f8697

  • SHA512

    e9d3df5b5dfaea9c1c8c2ec0cbe76041fced18960402f4e593405bca2cbfc36a20ba342b316bc25dc22941561244df83052a3b4eaf0bbfef2c8e8d40154b654c

  • SSDEEP

    196608:ICMpb7KX/Rdl9eN4x+yAiWfkHpdohXlRy8iPyDWt:oYX5bm27QfApsRydUWt

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.949019ade49da5e30314adfb89bf76d0.exe"
      2⤵
      • Loads dropped DLL
      PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI18082\python310.dll

    Filesize

    1.5MB

    MD5

    d366db026edf7875a5e3d0cf42808148

    SHA1

    fc60d2581c4cdb4f240d8769dc5154b1f48e616d

    SHA256

    6d70ac2367a5794aea069883c12261694755b79454337afbce4f672930652d7f

    SHA512

    479397f006cc943b61c11e229e22433fc2e0b3446359d0ea7f7b8882f953a1f1453920ccf6a674b1f076af316562573825cff33c23d6e7e0abc142b832377153

  • \Users\Admin\AppData\Local\Temp\_MEI18082\python310.dll

    Filesize

    1.5MB

    MD5

    d366db026edf7875a5e3d0cf42808148

    SHA1

    fc60d2581c4cdb4f240d8769dc5154b1f48e616d

    SHA256

    6d70ac2367a5794aea069883c12261694755b79454337afbce4f672930652d7f

    SHA512

    479397f006cc943b61c11e229e22433fc2e0b3446359d0ea7f7b8882f953a1f1453920ccf6a674b1f076af316562573825cff33c23d6e7e0abc142b832377153

  • memory/2952-28-0x000007FEF6370000-0x000007FEF67DF000-memory.dmp

    Filesize

    4.4MB