Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
31/10/2023, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.42398a81ff5a8a7fe5036545a1583980_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.42398a81ff5a8a7fe5036545a1583980_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.42398a81ff5a8a7fe5036545a1583980_JC.exe
-
Size
149KB
-
MD5
42398a81ff5a8a7fe5036545a1583980
-
SHA1
5c2bda50d5a73f2b389fdcf16fb3652529f36b87
-
SHA256
eb4e5b39ab9c64959e19832e9479f81eeb8db636a812f70d23ac380a4799abbe
-
SHA512
edb2c65cb4899d57a1be8a9d4826a0a937dc2b105e9aeb80e0cd15d23b90dd6f94c93aade331f4adcb6fa2b9bb2fff862c1c6208f8ec47a44f7d87d09a1b1d67
-
SSDEEP
3072:J/BH9p/3K+AEkzgXrGqJM4qd3bGjhkqsXb6:JR9pTAEkz6rGq4Bbq2u
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2732 wwljcul.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\wwljcul.exe NEAS.42398a81ff5a8a7fe5036545a1583980_JC.exe File created C:\PROGRA~3\Mozilla\sdwojsn.dll wwljcul.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2732 2616 taskeng.exe 29 PID 2616 wrote to memory of 2732 2616 taskeng.exe 29 PID 2616 wrote to memory of 2732 2616 taskeng.exe 29 PID 2616 wrote to memory of 2732 2616 taskeng.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.42398a81ff5a8a7fe5036545a1583980_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.42398a81ff5a8a7fe5036545a1583980_JC.exe"1⤵
- Drops file in Program Files directory
PID:1952
-
C:\Windows\system32\taskeng.exetaskeng.exe {41770042-41CA-465D-BF44-209EE30900A4} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\PROGRA~3\Mozilla\wwljcul.exeC:\PROGRA~3\Mozilla\wwljcul.exe -anxczaj2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD55979317c3a4d9caf52235ed9405f2ca6
SHA1a0a37b89360ddf1da62cfa5ce1721d979878ff7e
SHA256215c508d8432d487ba3f87264e28fa9e0b1b2f8cdfb7019f60b2f83f762f020b
SHA512d87a10177768e42de377a9b29d6bf67151ab739a76ecafcbe085e9bb89a881b03f5d54f1c34c42b3c67429b5e0f6f7eb2ee1e2bde9fa0bed5ffa539dd1e83720
-
Filesize
149KB
MD55979317c3a4d9caf52235ed9405f2ca6
SHA1a0a37b89360ddf1da62cfa5ce1721d979878ff7e
SHA256215c508d8432d487ba3f87264e28fa9e0b1b2f8cdfb7019f60b2f83f762f020b
SHA512d87a10177768e42de377a9b29d6bf67151ab739a76ecafcbe085e9bb89a881b03f5d54f1c34c42b3c67429b5e0f6f7eb2ee1e2bde9fa0bed5ffa539dd1e83720