Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe
-
Size
316KB
-
MD5
e348631fdb7bb5dd9c19e4f86860bcd0
-
SHA1
3dbc5c20721f4978d8ae88356edc74ea68c6d8b5
-
SHA256
b8954e91e06112ed6022f8575c0d16ee3da7c67286ef91e51a092e231b1ef393
-
SHA512
4cee0d4b39173cdc9cc490086f9c68b6d238522f30fb70eedf29b230f96811767a13b19c43c4aca5e4784f4403056755a12e4ed0843af90b1f970d3e500a61cd
-
SSDEEP
6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGE:dMgZXNOUBXXRTOAz+GE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3568 NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3480 wrote to memory of 3568 3480 NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe 32 PID 3480 wrote to memory of 3568 3480 NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe 32 PID 3480 wrote to memory of 3568 3480 NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back"C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back"2⤵
- Executes dropped EXE
PID:3568
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5f976a1b5a1ae38ea68e676804536e065
SHA19b87edfa6474b48dbb9e902c5e87318e241c70dc
SHA256bc97eabb1e73da71a8662725e9d3c36f2f8c9a35c8c2835f9869df10caa51a0d
SHA512790315b2f5c59722d55c550675b4ea6a0d4ffbd6bbb00597160b213056717e6392c23814936931eafa639fc9ddc616fd16c71ef56c6a5e30790d1bb7ede685fa
-
Filesize
316KB
MD5f976a1b5a1ae38ea68e676804536e065
SHA19b87edfa6474b48dbb9e902c5e87318e241c70dc
SHA256bc97eabb1e73da71a8662725e9d3c36f2f8c9a35c8c2835f9869df10caa51a0d
SHA512790315b2f5c59722d55c550675b4ea6a0d4ffbd6bbb00597160b213056717e6392c23814936931eafa639fc9ddc616fd16c71ef56c6a5e30790d1bb7ede685fa