Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

NEAS.3353d...b0.exe

windows7-x64

7

NEAS.3353d...b0.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.3353d66cf4c1314dafea0644b8e511b0.exe

  • Size

    1.5MB

  • Sample

    231031-ks2gladf54

  • MD5

    3353d66cf4c1314dafea0644b8e511b0

  • SHA1

    d4b498b5ab574ba4a9ac76e390a43e561708c333

  • SHA256

    ad94104b5647175c44cef805acf50abf59cbc93358986664473ea9370cd8652d

  • SHA512

    083e62de36d3c9a2b5d4ca8f39fa8ee3eb72702a3fbab8f73ef67e03dedc0f80b83d1b3ef64cecb371bb8596779d332e89706af8a47d9a0b2138be5caa569caa

  • SSDEEP

    24576:l9w72jQXq7Q3TUdZOq4Fd4w2f4Bpa82Ru79nIAc6vNPkhVT4FioKGUj:szXpDCZiF6opanR2lI7zT7

Score
7/10
bootkitevasionpersistencetrojan

Malware Config

Targets

    • Target

      NEAS.3353d66cf4c1314dafea0644b8e511b0.exe

    • Size

      1.5MB

    • MD5

      3353d66cf4c1314dafea0644b8e511b0

    • SHA1

      d4b498b5ab574ba4a9ac76e390a43e561708c333

    • SHA256

      ad94104b5647175c44cef805acf50abf59cbc93358986664473ea9370cd8652d

    • SHA512

      083e62de36d3c9a2b5d4ca8f39fa8ee3eb72702a3fbab8f73ef67e03dedc0f80b83d1b3ef64cecb371bb8596779d332e89706af8a47d9a0b2138be5caa569caa

    • SSDEEP

      24576:l9w72jQXq7Q3TUdZOq4Fd4w2f4Bpa82Ru79nIAc6vNPkhVT4FioKGUj:szXpDCZiF6opanR2lI7zT7

    Score
    7/10
    bootkitevasionpersistencetrojan

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks