Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 17:49

General

  • Target

    NEAS.286e590cfe5802b49cfb4176862a0390_JC.exe

  • Size

    153KB

  • MD5

    286e590cfe5802b49cfb4176862a0390

  • SHA1

    8b951bf7a0ccbeee3ebac0c3b9e2c37c48ad6e7e

  • SHA256

    ec243eb1fb6843c857bac421d6a60f9800c35cee506da5ba369a708d46a0c02e

  • SHA512

    ededa9cd4564071444da1f01653102ec9380913ffc2b9711af463b46e79089b74fe2abea9a3f2243d383113b29b1afed35b6e4baffd40c812b8590142eacf37e

  • SSDEEP

    3072:8UuCn53v9WYf7/LI4Lg1GX1rbNvQ7FeSBOzJYWx9Jv:jn5V/TLgOnNvGFWzj

Score
8/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.286e590cfe5802b49cfb4176862a0390_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.286e590cfe5802b49cfb4176862a0390_JC.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2104
  • C:\PROGRA~3\Mozilla\pgvdxmn.exe
    C:\PROGRA~3\Mozilla\pgvdxmn.exe -fumfguk
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\pgvdxmn.exe

    Filesize

    153KB

    MD5

    0e15932224dccb0b600f20956167e849

    SHA1

    d454b6e96d8cf5b20d46897548052db33be393fa

    SHA256

    10506fafe090a64210ce129196a9dbf52f8d8cafd392c30267246f2f88903e49

    SHA512

    f56f29bed5a2570d6e5a0dca929c46d7b5246f312e74862692e4697c1913b613d61b2b5070e157fb7522e4c3d09cb7909a88c52873cbd6e9ddcbc3d4cbeec4ec

  • C:\ProgramData\Mozilla\pgvdxmn.exe

    Filesize

    153KB

    MD5

    0e15932224dccb0b600f20956167e849

    SHA1

    d454b6e96d8cf5b20d46897548052db33be393fa

    SHA256

    10506fafe090a64210ce129196a9dbf52f8d8cafd392c30267246f2f88903e49

    SHA512

    f56f29bed5a2570d6e5a0dca929c46d7b5246f312e74862692e4697c1913b613d61b2b5070e157fb7522e4c3d09cb7909a88c52873cbd6e9ddcbc3d4cbeec4ec

  • memory/568-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/568-13-0x00000000008F0000-0x000000000094B000-memory.dmp

    Filesize

    364KB

  • memory/568-19-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2104-0-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2104-1-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2104-2-0x0000000000A00000-0x0000000000A5B000-memory.dmp

    Filesize

    364KB

  • memory/2104-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB