Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2023, 19:53

General

  • Target

    NEAS.4974df26a9e6b84577a351703ae429a0.exe

  • Size

    2.5MB

  • MD5

    4974df26a9e6b84577a351703ae429a0

  • SHA1

    148ad51f9779e67c210a8090f9ea6002366bd9fe

  • SHA256

    2d0e4d3a259a50ed3f7d1ea67be6ddf426f5b7dcacd5f494d00b78321c40d4e4

  • SHA512

    5e80e158af8850e575f9ca077f4538478fce0a8d1c5d746fb4e58d5ce37fecd6d79f0c97c83812c2b9ee763ac7c69291bf6c349104cb678d8b605bb6aa57d1b2

  • SSDEEP

    49152:y4daOqAehx7x20RKuniOJqfU7F1tLYoNovTE3pzNx0FOnpe4v/68M:cP7tRtrJq88SqgnpXiH

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in Program Files directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4974df26a9e6b84577a351703ae429a0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4974df26a9e6b84577a351703ae429a0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    PID:5108
  • C:\PROGRA~3\Mozilla\axfniqh.exe
    C:\PROGRA~3\Mozilla\axfniqh.exe -pdtylqd
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\axfniqh.exe

    Filesize

    2.5MB

    MD5

    ead2f2f96bb20311aa644cb96cef85f7

    SHA1

    8e61fb402c6730b93b860c12aee171df470f9d42

    SHA256

    f04b9e158a3203f57cf20761d289c285815d63fbf303382bc0a88e3a060c0f0a

    SHA512

    876e0be828fae988253b08b19a5a540153c9c9444867fdb5e3dafa7d0e37ac650515396a08229f036cd196cc542cf75aeefda2a18575d6a9c2f61154334d7162

  • C:\ProgramData\Mozilla\axfniqh.exe

    Filesize

    2.5MB

    MD5

    ead2f2f96bb20311aa644cb96cef85f7

    SHA1

    8e61fb402c6730b93b860c12aee171df470f9d42

    SHA256

    f04b9e158a3203f57cf20761d289c285815d63fbf303382bc0a88e3a060c0f0a

    SHA512

    876e0be828fae988253b08b19a5a540153c9c9444867fdb5e3dafa7d0e37ac650515396a08229f036cd196cc542cf75aeefda2a18575d6a9c2f61154334d7162

  • memory/2260-11-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB

  • memory/2260-23-0x0000000001810000-0x000000000186C000-memory.dmp

    Filesize

    368KB

  • memory/2260-22-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2260-19-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB

  • memory/2260-18-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2260-17-0x0000000001810000-0x000000000186C000-memory.dmp

    Filesize

    368KB

  • memory/2260-12-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB

  • memory/5108-4-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/5108-8-0x0000000002CC0000-0x0000000002D1C000-memory.dmp

    Filesize

    368KB

  • memory/5108-13-0x0000000000690000-0x0000000000A14000-memory.dmp

    Filesize

    3.5MB

  • memory/5108-15-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/5108-16-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/5108-5-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB

  • memory/5108-0-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB

  • memory/5108-3-0x0000000002CC0000-0x0000000002D1C000-memory.dmp

    Filesize

    368KB

  • memory/5108-2-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB

  • memory/5108-1-0x0000000000400000-0x0000000000A57000-memory.dmp

    Filesize

    6.3MB