Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:26
Behavioral task
behavioral1
Sample
NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe
Resource
win7-20230831-en
General
-
Target
NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe
-
Size
868KB
-
MD5
917ddfb1426ecc5efa1597f1ec0ad250
-
SHA1
15dceab9868e07e7b6bb19eb4f7b0c2f80645456
-
SHA256
4a2a94b6cef847969aff91623913eee7a7ec6684689d233cd87453e840157951
-
SHA512
af664700189800fe2cc40ed593453c06be4207c08f13d9d0241de11f67f691b8b50b5f5a08d58ee7ca9733de8d0c624d95eab2ac523126c50243b9cd44acdd4a
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt4qifJxI406KGhcNis:E5aIwC+Agr6StniB+5
Malware Config
Signatures
-
KPOT Core Executable 3 IoCs
resource yara_rule behavioral2/files/0x0006000000022e5c-22.dat family_kpot behavioral2/files/0x0006000000022e5c-23.dat family_kpot behavioral2/files/0x0006000000022e5c-60.dat family_kpot -
Trickbot x86 loader 5 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/3536-15-0x0000000002B30000-0x0000000002B59000-memory.dmp trickbot_loader32 behavioral2/memory/3536-19-0x0000000002B30000-0x0000000002B59000-memory.dmp trickbot_loader32 behavioral2/memory/3536-26-0x0000000002B30000-0x0000000002B59000-memory.dmp trickbot_loader32 behavioral2/memory/4436-44-0x0000000002070000-0x0000000002099000-memory.dmp trickbot_loader32 behavioral2/memory/4436-59-0x0000000002070000-0x0000000002099000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 3400 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3536 NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 3400 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3536 wrote to memory of 4436 3536 NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 89 PID 3536 wrote to memory of 4436 3536 NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 89 PID 3536 wrote to memory of 4436 3536 NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 89 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 PID 4436 wrote to memory of 2720 4436 NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.917ddfb1426ecc5efa1597f1ec0ad250.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exeC:\Users\Admin\AppData\Roaming\WinSocket\NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2720
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exeC:\Users\Admin\AppData\Roaming\WinSocket\NFAS.917ddfb1426ecc5efa1597f1ec0ad250.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
868KB
MD5917ddfb1426ecc5efa1597f1ec0ad250
SHA115dceab9868e07e7b6bb19eb4f7b0c2f80645456
SHA2564a2a94b6cef847969aff91623913eee7a7ec6684689d233cd87453e840157951
SHA512af664700189800fe2cc40ed593453c06be4207c08f13d9d0241de11f67f691b8b50b5f5a08d58ee7ca9733de8d0c624d95eab2ac523126c50243b9cd44acdd4a
-
Filesize
868KB
MD5917ddfb1426ecc5efa1597f1ec0ad250
SHA115dceab9868e07e7b6bb19eb4f7b0c2f80645456
SHA2564a2a94b6cef847969aff91623913eee7a7ec6684689d233cd87453e840157951
SHA512af664700189800fe2cc40ed593453c06be4207c08f13d9d0241de11f67f691b8b50b5f5a08d58ee7ca9733de8d0c624d95eab2ac523126c50243b9cd44acdd4a
-
Filesize
868KB
MD5917ddfb1426ecc5efa1597f1ec0ad250
SHA115dceab9868e07e7b6bb19eb4f7b0c2f80645456
SHA2564a2a94b6cef847969aff91623913eee7a7ec6684689d233cd87453e840157951
SHA512af664700189800fe2cc40ed593453c06be4207c08f13d9d0241de11f67f691b8b50b5f5a08d58ee7ca9733de8d0c624d95eab2ac523126c50243b9cd44acdd4a