Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c613bed72dd920f99b25a8e96df737c0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c613bed72dd920f99b25a8e96df737c0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c613bed72dd920f99b25a8e96df737c0.exe
-
Size
965KB
-
MD5
c613bed72dd920f99b25a8e96df737c0
-
SHA1
8704ca8e6198c55e7fc8f639963ddec28de55642
-
SHA256
4dbd75db53c3dc0f347234ff78429ba2045a3d75a8157f81bd5e9f12559605c1
-
SHA512
c29b202b9bfd8f87cf04c07a2ba79775ff2774b968d52e101da4ba1b45ab86d6abe65640a2028f8508072f192382bf33500220f1a7b0cc7d23d7e64f168c5d2e
-
SSDEEP
12288:i2ToLD2QfWUEknSsmjj/UVF4TRSEm8HFTjMVJK1P5aEL3L7yhxoeVsc:ikuPfWsnnw/UV+RSEm8HZMVcRaE2v1
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i" NEAS.c613bed72dd920f99b25a8e96df737c0.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1632 NEAS.c613bed72dd920f99b25a8e96df737c0.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
965KB
MD52837783d1bc0d13d80400a6c238b644c
SHA1c43071b988be9ea6d9516db5735828fb96d58610
SHA2560e314a765581ce20d6a1a256ddc5fa9159380d540f742fd0e297a33e7e9820ad
SHA5120d8e223dbae0a0cfe559c2dc5fd1c2d59276a95352a2f24b3613bfb3d4a5b550c1892edc6eb23f09723da84caab581c1939fe4a1bb64daba4625aa4dea9ab5e8