Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2023, 21:17

General

  • Target

    NEAS.3a733f3a4256d4e51bf038a9e2718690.exe

  • Size

    460KB

  • MD5

    3a733f3a4256d4e51bf038a9e2718690

  • SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

  • SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

  • SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • SSDEEP

    12288:/pLCnVtGQ6vRSDB4fkCmHQrBecfKZIeN:+ofHQaVfKZIeN

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Drops file in Drivers directory 7 IoCs
  • Executes dropped EXE 18 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.3a733f3a4256d4e51bf038a9e2718690.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.3a733f3a4256d4e51bf038a9e2718690.exe"
    1⤵
    • Adds policy Run key to start application
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\SysWOW64\drivers\logman.exe
      C:\Windows\System32\drivers\logman.exe /c 50
      2⤵
      • Executes dropped EXE
      PID:1788
    • C:\Users\Admin\Local Settings\Application Data\Microsoft\clipsrv.exe
      "C:\Users\Admin\Local Settings\Application Data\Microsoft\clipsrv.exe" /c 30
      2⤵
      • Executes dropped EXE
      PID:2952
    • C:\Windows\SysWOW64\drivers\mqtgsvc.exe
      C:\Windows\System32\drivers\mqtgsvc.exe /c 98
      2⤵
      • Executes dropped EXE
      PID:1636
    • C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe
      "C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe" /c 59
      2⤵
      • Executes dropped EXE
      PID:3664
    • C:\Windows\System\winlogon.exe
      C:\Windows\System\winlogon.exe /c 24
      2⤵
      • Executes dropped EXE
      PID:2800
    • C:\Windows\SysWOW64\drivers\cisvc.exe
      C:\Windows\System32\drivers\cisvc.exe /c 10
      2⤵
      • Executes dropped EXE
      PID:4584
    • C:\Users\Admin\Local Settings\Application Data\Microsoft\Windows\csrss.exe
      "C:\Users\Admin\Local Settings\Application Data\Microsoft\Windows\csrss.exe" /c 71
      2⤵
      • Executes dropped EXE
      PID:4372
    • C:\Users\Admin\Local Settings\Application Data\Microsoft\logman.exe
      "C:\Users\Admin\Local Settings\Application Data\Microsoft\logman.exe" /c 60
      2⤵
      • Executes dropped EXE
      PID:2912
    • C:\Windows\SysWOW64\drivers\logman.exe
      C:\Windows\System32\drivers\logman.exe /c 35
      2⤵
      • Executes dropped EXE
      PID:4840
    • C:\Windows\SysWOW64\drivers\logman.exe
      C:\Windows\System32\drivers\logman.exe /r
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\SysWOW64\drivers\logman.exe
        C:\Windows\System32\drivers\logman.exe /c 91
        3⤵
        • Executes dropped EXE
        PID:3416
      • C:\Users\Admin\Local Settings\Application Data\Microsoft\clipsrv.exe
        "C:\Users\Admin\Local Settings\Application Data\Microsoft\clipsrv.exe" /c 84
        3⤵
        • Executes dropped EXE
        PID:2392
      • C:\Windows\SysWOW64\drivers\mqtgsvc.exe
        C:\Windows\System32\drivers\mqtgsvc.exe /c 49
        3⤵
        • Executes dropped EXE
        PID:4836
      • C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe
        "C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe" /c 70
        3⤵
        • Executes dropped EXE
        PID:3860
      • C:\Windows\SysWOW64\drivers\cisvc.exe
        C:\Windows\System32\drivers\cisvc.exe /c 58
        3⤵
        • Executes dropped EXE
        PID:4116
      • C:\Windows\System\winlogon.exe
        C:\Windows\System\winlogon.exe /c 19
        3⤵
        • Executes dropped EXE
        PID:484
      • C:\Users\Admin\Local Settings\Application Data\Microsoft\logman.exe
        "C:\Users\Admin\Local Settings\Application Data\Microsoft\logman.exe" /c 68
        3⤵
        • Executes dropped EXE
        PID:880
      • C:\Users\Admin\Local Settings\Application Data\Microsoft\Windows\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\Microsoft\Windows\csrss.exe" /c 68
        3⤵
        • Executes dropped EXE
        PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\csrss.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\csrss.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\clipsrv.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\clipsrv.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\sessmgr.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Microsoft\sessmgr.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\AppData\Local\Temp\Twain002.Mtx

    Filesize

    10B

    MD5

    25a52a5537fc423bcadb51b4d3e8bcf0

    SHA1

    1700f19c3c0075753ec66523c0432b59051aba92

    SHA256

    e8b7782bc9b7ba6efb5f9baded8e942ad586c29776b61d59e8c86b50f0b3da0b

    SHA512

    3ba1cbd66429ad587004870bc84c34f7830a73e58a4e94caddea3f2aa52a200d8073859caaae224d966ebdaabbe2f5d806c59f696809da445f0756f2eacb1e83

  • C:\Users\Admin\Local Settings\Application Data\Microsoft\Windows\csrss.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\Local Settings\Application Data\Microsoft\clipsrv.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\Local Settings\Application Data\Microsoft\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Users\Admin\Local Settings\Application Data\Microsoft\sessmgr.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\cisvc.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\cisvc.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\cisvc.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\logman.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\mqtgsvc.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\mqtgsvc.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\SysWOW64\drivers\mqtgsvc.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\System\winlogon.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\System\winlogon.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d

  • C:\Windows\System\winlogon.exe

    Filesize

    460KB

    MD5

    3a733f3a4256d4e51bf038a9e2718690

    SHA1

    3a582e204d57583d98b0f47d84ab5dc0cfbd6e9b

    SHA256

    c856acce2066925b44bdaba33ef2ade9f7ad04f3c696bc283a31c0776d087954

    SHA512

    3a46eede2b03a24d06b5f4ff65d31fc452e31a9e5bc3d5306958e1c20e77794029ad9ca5052bc7c4a6449a52c08e9d373ffab0da1facd79bab32053d403da62d