Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    171s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2023, 20:19

General

  • Target

    NEAS.fc3775a630ef13715d49130070924f90.exe

  • Size

    475KB

  • MD5

    fc3775a630ef13715d49130070924f90

  • SHA1

    8266716aecf689149dafaf747fb179c5bbfab63c

  • SHA256

    c05f48cec5b71e33d3f2688202c58bb254707850a189c73f70f2d98cb97a22dd

  • SHA512

    e3b07fdae572335e6369002c166a0e262d4e00b7b19251c34b5a17ff6e24f1c6887a65428d47cf092ca27af64d606434f7a8bce94c608e2b7206784378c102d5

  • SSDEEP

    6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElY:nRDc3yWDNU+YUznzNjElWaT07NQtY

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.fc3775a630ef13715d49130070924f90.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.fc3775a630ef13715d49130070924f90.exe"
    1⤵
    • Modifies firewall policy service
    • Adds policy Run key to start application
    • Sets service image path in registry
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:1812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\msrpc.exe

    Filesize

    475KB

    MD5

    0613ae40e4b551d2ebc2e01b21b205ff

    SHA1

    c508845b73b9cf21ac562606043970b8309ef535

    SHA256

    ca80d2ec736b9b81eade3f510965e00aa2083bae79315850e3127e429f2ff351

    SHA512

    b7041ea58d1a23685f9df362c3e9228cbdfe4111ad98d59d44f07c39fd7015ed788be1a4933f6955d6e7faf8771e2b125bfe13a841c575f10e4af020fa6006de

  • memory/1812-0-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/1812-1-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-2-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/1812-20-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-21-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-22-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-23-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-24-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-25-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-26-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1812-27-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB