Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.34f080ebba4a6849a3cad967e4e6a550.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.34f080ebba4a6849a3cad967e4e6a550.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.34f080ebba4a6849a3cad967e4e6a550.exe
-
Size
396KB
-
MD5
34f080ebba4a6849a3cad967e4e6a550
-
SHA1
e0055d5229766796bce3ef29ed2d96a8223ad22d
-
SHA256
5fcbe9d64c025042d87a8302735717b1f338dd87abb211839914a5642be708a9
-
SHA512
7656dbfd3cb65287fa99ad2e44eebeb8b75b57f90d4c52e636ce63c541bec26906cead57569d6ed545a2c9e3b1a04feabca846e3ada20e786663d57dba318c96
-
SSDEEP
6144:p731bdBaBoC3u2wjsHtCsHvw2ycqc8XGc87vhkzhVhE0TudhtqE:p1b43EsHBvw+8XNuvUE0Y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" NEAS.34f080ebba4a6849a3cad967e4e6a550.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6C12.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\sIRC4.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6431.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX58BB.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6BF2.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX58DB.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6BB2.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6C32.tmp NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.34f080ebba4a6849a3cad967e4e6a550.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD534f080ebba4a6849a3cad967e4e6a550
SHA1e0055d5229766796bce3ef29ed2d96a8223ad22d
SHA2565fcbe9d64c025042d87a8302735717b1f338dd87abb211839914a5642be708a9
SHA5127656dbfd3cb65287fa99ad2e44eebeb8b75b57f90d4c52e636ce63c541bec26906cead57569d6ed545a2c9e3b1a04feabca846e3ada20e786663d57dba318c96