Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 18:31
Behavioral task
behavioral1
Sample
NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe
-
Size
279KB
-
MD5
9f8f8ecb396a7a43411173af9f2e62d0
-
SHA1
576571b5950292feeb00554c0d33c878048bdac2
-
SHA256
7b16389e3c2dec148017f6ef3406c2e322fb20eb0e9706eacfcbebb9533ffd36
-
SHA512
515392df5bb09153569a7809ff36d33ecbe8f62df3db9620082b0ff4274911f73894a28fe859ce399bdfa17b7a90897c2bdde5743d432ad2bfd3a727b308da47
-
SSDEEP
6144:uuq1yy/pjnkeQ4m13YSfZgaPlWERGKjwjglIQ2beZ:y1yc9kbJ3YyrlWqGewj4IQ2bc
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1984-0-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/files/0x0007000000015c7c-5.dat upx behavioral1/memory/1984-18-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ZnId.com NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\win32dc\Half-Life 2(codes).exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\Counter-Strike + patch.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\Half-Life 2 + codes.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\BattleField 1942 crack.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\BattleField 1942_crack.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\Half-Life 2_nocd.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\BattleField 1942 crack.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\BattleField 1942(hack).exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\DAoC_cdfix.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\Sims 2 cdfix.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\BattleField 1942(hack).exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\Sims 2 cdfix.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\Half-Life 2(codes).exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\Counter-Strike + patch.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\DAoC_cdfix.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File created C:\Windows\win32dc\Counter-Strike + hack.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\Counter-Strike + hack.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe File opened for modification C:\Windows\win32dc\Half-Life 2 + codes.exe NEAS.9f8f8ecb396a7a43411173af9f2e62d0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
279KB
MD5e82fe2e3beaf083ea1a7b7e018ce012d
SHA17c707743c79937d5856a9004e19f7baee8a61b53
SHA25685d79a99494e5744c65070b752490e113aa471b0a77df3e967c50844f3621211
SHA512bbb666f13dad42f226df614761149f17e6263364ebafed6943b2d9004960662b3feac3636a57b3334f04a761c0167cfa65e0429b8acdd5e13dd5762ac1f8e223