Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe
-
Size
249KB
-
MD5
098fdb658f90a3bba3b3f0280c952580
-
SHA1
d25eba00706a642e2dd83514fe3303d2cb0749db
-
SHA256
15ae65aa18ce3eae724c85745de8975a15b86307b3d7d6effbc7ea8541c2e5e2
-
SHA512
c477a8cc27aca6da317c83864bab9aede8d3acd1a377ced7d172eaaa8e075a7685f8e94b1635aac386786b59e0cb887517f44b8d3d5a014ed4639b482aeb56fd
-
SSDEEP
6144:7sZJCstu4PJg5/Ly0d8YaDRVHTVtSbGqJP:Yy5zyNYaHHDSf
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2212 ghezyal.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\dptkppg.dll ghezyal.exe File created C:\PROGRA~3\Mozilla\ghezyal.exe NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.098fdb658f90a3bba3b3f0280c952580_JC.exe"1⤵
- Drops file in Program Files directory
PID:1940
-
C:\PROGRA~3\Mozilla\ghezyal.exeC:\PROGRA~3\Mozilla\ghezyal.exe -cypomaj1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD547d283650d965d01040b47ed4dbf7319
SHA1742a2901e7359cdc6355febecc649d4d3110bef5
SHA256f4552d8fff08ae2b36acd6fc962320262aed820b5c81b4838c49f5058db49f73
SHA512c64d221177e2378fa9ef3d44366afc183487ba49846a1aaff41d976fe2f25b4336f3ddeb3bb432d216ee63baa947b7728d6deab3a1bee78f2a37ab5a5b0e0560
-
Filesize
249KB
MD547d283650d965d01040b47ed4dbf7319
SHA1742a2901e7359cdc6355febecc649d4d3110bef5
SHA256f4552d8fff08ae2b36acd6fc962320262aed820b5c81b4838c49f5058db49f73
SHA512c64d221177e2378fa9ef3d44366afc183487ba49846a1aaff41d976fe2f25b4336f3ddeb3bb432d216ee63baa947b7728d6deab3a1bee78f2a37ab5a5b0e0560