Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

NEAS.34436...60.exe

windows7-x64

7

NEAS.34436...60.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2023, 19:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.34436f4ebf51dc2e6ebe9771345b6a60.exe

  • Size

    555KB

  • MD5

    34436f4ebf51dc2e6ebe9771345b6a60

  • SHA1

    b49b7dc45c0c96dfaf3963fc1dd15fd3177805f9

  • SHA256

    cb04b31e9dfedccf242268bb3d6cd704f248854b95e843ee839f8b526aa2b6e7

  • SHA512

    bf9eea0039ba93adbd0926a57fca927d71923d1e318bae4680d62fbcea40123c8b204284c418803d9f63e30015f3319b513b430637c83aa2a40e054c3c03245b

  • SSDEEP

    12288:bytbV3kSoXaLnFosJSXTrtka3iAbeXWueWNjXOVaPrHlK:ab5kSYaLFVJSDOa3iAb070sFK

Score
1/10

Malware Config

Signatures

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.34436f4ebf51dc2e6ebe9771345b6a60.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.34436f4ebf51dc2e6ebe9771345b6a60.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\NEAS.34436f4ebf51dc2e6ebe9771345b6a60.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\system32\PING.EXE
        ping 1.1.1.1 -n 1 -w 6000
        3⤵
        • Runs ping.exe
        PID:4380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1992-0-0x00007FF64CFB0000-0x00007FF64CFFE000-memory.dmp

    Filesize

    312KB

    Download

  • memory/1992-2-0x00007FF64CFB0000-0x00007FF64CFFE000-memory.dmp

    Filesize

    312KB

    Download