Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
16/10/2023, 18:16
General
-
Target
NEAS.2f730c0c652382fb02c9619865971510.exe
-
Size
741KB
-
MD5
2f730c0c652382fb02c9619865971510
-
SHA1
8ec21234062163c9765d6aab75b8243597a1aa02
-
SHA256
b40efaeb4eacd8259e6e0c447e0f18a7882a7c46e8039e986b074704ca175fa3
-
SHA512
33f915a77b264d785c5edde324c6bf0442653e892984fbe742042a0a82db20802402e3c7817c2e39b55dd24aa220539fc5d249e5ceaca622b135d36ba597c01b
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fp:lIt4kt0Kd6F6CNzYhUiEWEYcwh
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2f730c0c652382fb02c9619865971510.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2f730c0c652382fb02c9619865971510.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD5d6c25c08e77d10683f9c6f59b8b63687
SHA139bc2d8551a2d11f7a85bde92f8ddebf8460d71e
SHA2561a70022b6e2323c04e2e9e2188f50dbfd44bba6934aa495aa8b4070557f3f7ea
SHA512b42acc15021f6657e2de6972d375ec2046a968991b68236b96a82c4823a0d60b16f57f211e26d248662568d3ae4b51a543ef5f686945db2fa15aff8da21325f1
-
Filesize
741KB
MD5003b6291d7fb387f4468a16a2e0e6c34
SHA132fdece39335bfb0f3f8bba3bf60ec06107f745e
SHA256df3cb5d58cd0ed857dd96e3690a26f45f4d3eac24b1daf54069e85c1cad11fed
SHA51258920561caf6ae8782ddde04298a0a269b79dfe148843a8e037c61dcb1be6994724a958adf7b172fa212ac92f765604fccb66823cd095eebf25e217ff9ebbcfb
-
Filesize
741KB
MD5003b6291d7fb387f4468a16a2e0e6c34
SHA132fdece39335bfb0f3f8bba3bf60ec06107f745e
SHA256df3cb5d58cd0ed857dd96e3690a26f45f4d3eac24b1daf54069e85c1cad11fed
SHA51258920561caf6ae8782ddde04298a0a269b79dfe148843a8e037c61dcb1be6994724a958adf7b172fa212ac92f765604fccb66823cd095eebf25e217ff9ebbcfb
-
Filesize
741KB
MD5003b6291d7fb387f4468a16a2e0e6c34
SHA132fdece39335bfb0f3f8bba3bf60ec06107f745e
SHA256df3cb5d58cd0ed857dd96e3690a26f45f4d3eac24b1daf54069e85c1cad11fed
SHA51258920561caf6ae8782ddde04298a0a269b79dfe148843a8e037c61dcb1be6994724a958adf7b172fa212ac92f765604fccb66823cd095eebf25e217ff9ebbcfb
-
Filesize
741KB
MD5d21e9d81a7d423f93ff8a32b7d06bda0
SHA1a443db5b6c3d7ed78bccd205b58a49e45b8e3319
SHA256670bdd71908cb98e43e43a5ef6499de548f8a209ca55e0ea91ad57f173780e50
SHA512d6ef6788ad5c57c0d198e8015edb6755fcc29a6a9d763d80bfe237c7b56599a774cfd70073012461a09451c5e9feae4dc5413e24dd4a00ccaed2c918969738d8
-
Filesize
741KB
MD5003b6291d7fb387f4468a16a2e0e6c34
SHA132fdece39335bfb0f3f8bba3bf60ec06107f745e
SHA256df3cb5d58cd0ed857dd96e3690a26f45f4d3eac24b1daf54069e85c1cad11fed
SHA51258920561caf6ae8782ddde04298a0a269b79dfe148843a8e037c61dcb1be6994724a958adf7b172fa212ac92f765604fccb66823cd095eebf25e217ff9ebbcfb
-
Filesize
741KB
MD5d21e9d81a7d423f93ff8a32b7d06bda0
SHA1a443db5b6c3d7ed78bccd205b58a49e45b8e3319
SHA256670bdd71908cb98e43e43a5ef6499de548f8a209ca55e0ea91ad57f173780e50
SHA512d6ef6788ad5c57c0d198e8015edb6755fcc29a6a9d763d80bfe237c7b56599a774cfd70073012461a09451c5e9feae4dc5413e24dd4a00ccaed2c918969738d8
-
Filesize
741KB
MD5d6c25c08e77d10683f9c6f59b8b63687
SHA139bc2d8551a2d11f7a85bde92f8ddebf8460d71e
SHA2561a70022b6e2323c04e2e9e2188f50dbfd44bba6934aa495aa8b4070557f3f7ea
SHA512b42acc15021f6657e2de6972d375ec2046a968991b68236b96a82c4823a0d60b16f57f211e26d248662568d3ae4b51a543ef5f686945db2fa15aff8da21325f1
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB