Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
22/10/2023, 17:20
Behavioral task
behavioral1
Sample
NEAS.65b63b818157265abb5d6b2a6c671030.exe
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.65b63b818157265abb5d6b2a6c671030.exe
Resource
win10v2004-20231020-en
3 signatures
150 seconds
General
-
Target
NEAS.65b63b818157265abb5d6b2a6c671030.exe
-
Size
9.1MB
-
MD5
65b63b818157265abb5d6b2a6c671030
-
SHA1
9bab3a77c6afc460513fa42d5decab9daf4c8ae9
-
SHA256
d1eadb0f53b2c6950f4377321560e9d3853b1796d1dcfd7f5e132143d53de67f
-
SHA512
9810e3aa71608cebf49304e225542b32caacea7c6d906436d7abba1995d7bb1ab8d390e5b41a81a6d39a94cc003eb27c36291b0d511297b78d666ebed6ac7a7c
-
SSDEEP
196608:UbFb3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mdoNkBLOrrDfgZeVmCJWly:UbFb3bPk5HPhJCdBBB8Y7y
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1100-0-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\ehome\ehrecvr.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehprivjob.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehrec.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehvid.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\loadmxf.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\Boot\PCAT\memtest.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehexthost.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehshell.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehtray.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\bfsvc.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehsched.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\CreateDisc\SBEServer.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe File created C:\Windows\ehome\ehmsas.exe NEAS.65b63b818157265abb5d6b2a6c671030.exe