Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
-
Size
115KB
-
Sample
231031-kwfz3afd45
-
MD5
a57eaa2ea5075b1d8f2b95e6963f6100
-
SHA1
acd594d17df8533e8e70ef54c0b6133d93571239
-
SHA256
4a7777b80972e273adedcef4e8db13dc6267cf1114b23ab29e9e613a44299a9a
-
SHA512
f357caf639d9fdf3d44c8d74738f2afb1d38059a0f5267241cc65a39d71204bcdbe9b4a30ca3be75803dd9f75ef2e68b2321110b12c231418600af586bb3c227
-
SSDEEP
3072:xqBFJLzgOJJ6Ia0fe+CUGXQV8HiKxh2pvFE:wPdZxfvtGXQV8CyEfE
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
Resource
win10v2004-20231020-en
Malware Config
Targets
-
-
Target
NEAS.a57eaa2ea5075b1d8f2b95e6963f6100.exe
-
Size
115KB
-
MD5
a57eaa2ea5075b1d8f2b95e6963f6100
-
SHA1
acd594d17df8533e8e70ef54c0b6133d93571239
-
SHA256
4a7777b80972e273adedcef4e8db13dc6267cf1114b23ab29e9e613a44299a9a
-
SHA512
f357caf639d9fdf3d44c8d74738f2afb1d38059a0f5267241cc65a39d71204bcdbe9b4a30ca3be75803dd9f75ef2e68b2321110b12c231418600af586bb3c227
-
SSDEEP
3072:xqBFJLzgOJJ6Ia0fe+CUGXQV8HiKxh2pvFE:wPdZxfvtGXQV8CyEfE
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-