Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    269s
  • max time network
    320s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2023, 18:31

General

  • Target

    NEAS.a55c29117ae89e88594821a99f607f20.exe

  • Size

    220KB

  • MD5

    a55c29117ae89e88594821a99f607f20

  • SHA1

    afd3260767864121001edc729d0892c9c4905949

  • SHA256

    2d6c0e0739caa8fb53bf16ecbd9f6cf19b7ab380480f3b72bac5d0cb5833fc17

  • SHA512

    870272341a34516980af64721e25f9395281fc5a6b8f772095b1e5a02d1defd146b46944413cb114056f2408b3b3cdb278805bb0e89d4d9b762a18d3e259ca51

  • SSDEEP

    3072:XlOcumc7pFeqjQu/LGwnRoak/PWiud3uWHWABIippBC:1OCc3eqjawnRNk/PWiuvBRppBC

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.a55c29117ae89e88594821a99f607f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a55c29117ae89e88594821a99f607f20.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:2636
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {834D0D08-511E-41A2-B0C4-29E1CBEC3FF9} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\PROGRA~3\Mozilla\yzgwzlh.exe
      C:\PROGRA~3\Mozilla\yzgwzlh.exe -chuvxnb
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:2504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\yzgwzlh.exe

    Filesize

    220KB

    MD5

    e0c312ea6b499aaa54840aed73cf3d1b

    SHA1

    a3ce550a965643be0d44c54837b944f9540d4e95

    SHA256

    c0ce76e018cc5202c8f712fd5d2e8347200d13205c4a4f65329cf02505e4fc82

    SHA512

    88216a78275b0b2a4020f63b3ecd6aacbd68d77f2573f010cca3571f494d152e200d2bb13f1d72c846abe37e935cfe26eb462460487e984bcc3ea4333db47aa1

  • C:\PROGRA~3\Mozilla\yzgwzlh.exe

    Filesize

    220KB

    MD5

    e0c312ea6b499aaa54840aed73cf3d1b

    SHA1

    a3ce550a965643be0d44c54837b944f9540d4e95

    SHA256

    c0ce76e018cc5202c8f712fd5d2e8347200d13205c4a4f65329cf02505e4fc82

    SHA512

    88216a78275b0b2a4020f63b3ecd6aacbd68d77f2573f010cca3571f494d152e200d2bb13f1d72c846abe37e935cfe26eb462460487e984bcc3ea4333db47aa1

  • memory/2504-8-0x00000000008C0000-0x000000000091B000-memory.dmp

    Filesize

    364KB

  • memory/2504-9-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2504-11-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2504-12-0x00000000008C0000-0x000000000091B000-memory.dmp

    Filesize

    364KB

  • memory/2636-1-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2636-2-0x0000000000260000-0x00000000002BB000-memory.dmp

    Filesize

    364KB

  • memory/2636-0-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2636-4-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2636-5-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB