Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2023, 15:23

General

  • Target

    NEAS.48e08a227d24bbeaaaec6214d78a9be0_JC.exe

  • Size

    152KB

  • MD5

    48e08a227d24bbeaaaec6214d78a9be0

  • SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

  • SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

  • SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • SSDEEP

    3072:MEmcbqLl7DzEUGuoB+AKt0S/sCtCkSkBY:MEQLl7nEeZAW/saS

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.48e08a227d24bbeaaaec6214d78a9be0_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.48e08a227d24bbeaaaec6214d78a9be0_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\NEAS.48e08a227d24bbeaaaec6214d78a9be0_JC.exe
      72
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Loads dropped DLL
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Users\Admin\qixer.exe
        "C:\Users\Admin\qixer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Users\Admin\qixer.exe
          72
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Maps connected drives based on registry
          • Drops autorun.inf file
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\c\RCXD4BF.tmp

    Filesize

    152KB

    MD5

    2206fb84bfadfbfd390eb4f6d210ae8d

    SHA1

    673cdffdefc1954b1d6e2748cb8ec3ce5944ef44

    SHA256

    fab6b729594ee5dff141a1f54ce175671224db2b98f10fe476ecbfd9796a6601

    SHA512

    99eb9141abd55e42ac15882a045fb77a2a93c530a2fdf0d548896b22658367ef61553196115fa8427a31da5233577b39feeab8c096c46417a4670a9a58010fd5

  • C:\Users\Admin\qixer.exe

    Filesize

    152KB

    MD5

    48e08a227d24bbeaaaec6214d78a9be0

    SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

    SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

    SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • C:\Users\Admin\qixer.exe

    Filesize

    152KB

    MD5

    48e08a227d24bbeaaaec6214d78a9be0

    SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

    SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

    SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • C:\Users\Admin\qixer.exe

    Filesize

    152KB

    MD5

    48e08a227d24bbeaaaec6214d78a9be0

    SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

    SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

    SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • C:\Users\Admin\qixer.exe

    Filesize

    152KB

    MD5

    48e08a227d24bbeaaaec6214d78a9be0

    SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

    SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

    SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • \Users\Admin\qixer.exe

    Filesize

    152KB

    MD5

    48e08a227d24bbeaaaec6214d78a9be0

    SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

    SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

    SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • \Users\Admin\qixer.exe

    Filesize

    152KB

    MD5

    48e08a227d24bbeaaaec6214d78a9be0

    SHA1

    e38f028fd1842a8efb44fcf38f219755bc956ba1

    SHA256

    662ad778857ad12c547a5d33656b46b2533d3ce9d1d48c3edd6db18efa622769

    SHA512

    6f754f4222ecf33a22225f29bfd08439c7561f2aff4e16b6e8c64893ae51bdc19fcfd727532d751a27894815a29cc1d5404f0cca06513365ef21d5b54ad56508

  • memory/1820-70-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-90-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-2-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-4-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-62-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-92-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-80-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-26-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-72-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-88-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-74-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-86-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-76-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-84-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-78-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1820-82-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-27-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-81-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-79-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-83-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-77-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-85-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-75-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-87-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-73-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-89-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-71-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-91-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-69-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2824-93-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB