Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 20:41

General

  • Target

    NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe

  • Size

    249KB

  • MD5

    098fdb658f90a3bba3b3f0280c952580

  • SHA1

    d25eba00706a642e2dd83514fe3303d2cb0749db

  • SHA256

    15ae65aa18ce3eae724c85745de8975a15b86307b3d7d6effbc7ea8541c2e5e2

  • SHA512

    c477a8cc27aca6da317c83864bab9aede8d3acd1a377ced7d172eaaa8e075a7685f8e94b1635aac386786b59e0cb887517f44b8d3d5a014ed4639b482aeb56fd

  • SSDEEP

    6144:7sZJCstu4PJg5/Ly0d8YaDRVHTVtSbGqJP:Yy5zyNYaHHDSf

Score
8/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1940
  • C:\PROGRA~3\Mozilla\ghezyal.exe
    C:\PROGRA~3\Mozilla\ghezyal.exe -cypomaj
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\ghezyal.exe

    Filesize

    249KB

    MD5

    47d283650d965d01040b47ed4dbf7319

    SHA1

    742a2901e7359cdc6355febecc649d4d3110bef5

    SHA256

    f4552d8fff08ae2b36acd6fc962320262aed820b5c81b4838c49f5058db49f73

    SHA512

    c64d221177e2378fa9ef3d44366afc183487ba49846a1aaff41d976fe2f25b4336f3ddeb3bb432d216ee63baa947b7728d6deab3a1bee78f2a37ab5a5b0e0560

  • C:\ProgramData\Mozilla\ghezyal.exe

    Filesize

    249KB

    MD5

    47d283650d965d01040b47ed4dbf7319

    SHA1

    742a2901e7359cdc6355febecc649d4d3110bef5

    SHA256

    f4552d8fff08ae2b36acd6fc962320262aed820b5c81b4838c49f5058db49f73

    SHA512

    c64d221177e2378fa9ef3d44366afc183487ba49846a1aaff41d976fe2f25b4336f3ddeb3bb432d216ee63baa947b7728d6deab3a1bee78f2a37ab5a5b0e0560

  • memory/1940-0-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1940-1-0x0000000002210000-0x000000000226C000-memory.dmp

    Filesize

    368KB

  • memory/1940-2-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/1940-5-0x0000000002210000-0x000000000226C000-memory.dmp

    Filesize

    368KB

  • memory/1940-7-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2212-8-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2212-10-0x0000000000C60000-0x0000000000CBC000-memory.dmp

    Filesize

    368KB

  • memory/2212-11-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2212-13-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2212-15-0x0000000000C60000-0x0000000000CBC000-memory.dmp

    Filesize

    368KB