Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2023, 21:22

General

  • Target

    NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe

  • Size

    932KB

  • MD5

    67a4684a51d2e106b3f069a6f28e05f0

  • SHA1

    9fb5c126859d57ae108d1745a3a329662ba94ed4

  • SHA256

    01775091c988493242bfa729e0fcd20df9942581aaf9b0e0e217945b4ae93117

  • SHA512

    656aaba07d4cde3273a0ae4102892c23b9ddc66aedb7c25aa94aa72c66fee8fdda29d7a326d319017d2747467f2ea17f01b0d0dfbb6ca29d572cb9776029b4f2

  • SSDEEP

    12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdqLYF9mH7EEV:P1/aGLDCM4D8ayGMZo8/Nm/a2dLy0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\ProgramData\vqxji.exe
      "C:\ProgramData\vqxji.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache .exe

    Filesize

    932KB

    MD5

    b22f5244171de65ba3054af54eed3bea

    SHA1

    e86c6315189ad8c99e9ea81f42715760a22b1f5e

    SHA256

    adb18575dc1687bb2d41375ab87117688e81eda9d3f79cc81771d947890124c4

    SHA512

    fdd5e233f61804a50202349119616052638a43bce89cc72948e3547d85d0f46b0602408e12bdfd168c27ebea2eff8dae8dc7500d1cb98d6c8971822e7dca39d0

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\vqxji.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • C:\ProgramData\vqxji.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • C:\ProgramData\vqxji.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • \ProgramData\vqxji.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • \ProgramData\vqxji.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • memory/1528-100-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2200-10-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB