Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2023, 21:22

General

  • Target

    NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe

  • Size

    932KB

  • MD5

    67a4684a51d2e106b3f069a6f28e05f0

  • SHA1

    9fb5c126859d57ae108d1745a3a329662ba94ed4

  • SHA256

    01775091c988493242bfa729e0fcd20df9942581aaf9b0e0e217945b4ae93117

  • SHA512

    656aaba07d4cde3273a0ae4102892c23b9ddc66aedb7c25aa94aa72c66fee8fdda29d7a326d319017d2747467f2ea17f01b0d0dfbb6ca29d572cb9776029b4f2

  • SSDEEP

    12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdqLYF9mH7EEV:P1/aGLDCM4D8ayGMZo8/Nm/a2dLy0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.67a4684a51d2e106b3f069a6f28e05f0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\ProgramData\xsbac.exe
      "C:\ProgramData\xsbac.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    932KB

    MD5

    40f66a658b5df1c38688b3aa4f41ef0b

    SHA1

    fb9b1ae804bd378eb4f722d9c74b095da3bf2d9e

    SHA256

    868380ea449a5a8c0627b34a980939d11b36330374ea68cbd5b71993403610ce

    SHA512

    97042030107bb11ef1106b6ef52dc01da9e6789577801aedf2e81d224a3d4e21d276b17eb72ac40bb607af029b170df306afa1ab736e51a5d4c1dc4ae90645c1

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\xsbac.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • C:\ProgramData\xsbac.exe

    Filesize

    454KB

    MD5

    9425be4ca83d4074d9548660c44f5f00

    SHA1

    001a9605a60078afed240145d161d4e9e6ad33d6

    SHA256

    1ea1deac91f5eb59a7fc0c2045afd5796f9193c8cd52c6d93e5f218a52568643

    SHA512

    fe38815ae5035497d166cf0a0469b976a2961f2c8b4aada43d945cb2ef5acc8fc7e0b4fa884feb5f76ead623a4dca2637b63b445174c4382f4bcce66bcbeb6a1

  • memory/892-7-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4292-70-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB