Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

NEAS.d4d14...50.exe

windows7-x64

8

NEAS.d4d14...50.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 00:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.d4d141ea0704cc04fadada66ddfed750.exe

  • Size

    762KB

  • MD5

    d4d141ea0704cc04fadada66ddfed750

  • SHA1

    2225e3e162afe97c2ebf6a0913c65449633c82dd

  • SHA256

    b0b5b720919001a5da434e0c95f49ae165ed7b850498883f6a7d44c2f183fec0

  • SHA512

    2cada0a81ef3e9b2940c410765f4a85688cfa4abf6de982116ad120ffc76fbb20390b7472b961a1cb2207ce4191ae8973b3185def260576dfa968bbc80ef11dc

  • SSDEEP

    12288:XTbrv/fSvjx+pckifiTcnUlEs471tsVSaEVg3V0H9:zSUj4ZtsfEa3V0d

Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 20 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d4d141ea0704cc04fadada66ddfed750.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d4d141ea0704cc04fadada66ddfed750.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797299\OOLiveUpdateWorker.exe
      "C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797299\OOLiveUpdateWorker.exe" -ProgramName "Unknown" -InstalledLocation "C:\Users\Admin\AppData\Local\Temp\\" -WindowRec "367 176"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2328
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A88C01EC98D34B4BDC2AA2BF874C1D
    Filesize

    471B

    MD5

    56d19b2ea2d0d57a1663c264209197a7

    SHA1

    665d657dfe5c760c9362be19177f91de134681c5

    SHA256

    f161561da827369e2e6b7c02d94a08b6a34f4b83a6c46e33fad99147236000f7

    SHA512

    0c8ebf2d758dc71be0170b08c3a905b9d0c048825f06e050a42ae6cbbcefe725b9e919bcd5507cb31ca617c1bec1d064bbf7daa739e53514e4c97f196947d5de

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    2KB

    MD5

    4cf1da8d132d43ab05e3d69f591bf0ec

    SHA1

    1741a8a439dec6e9f991db606da4fc226cf240d4

    SHA256

    2cde1331fa0e4d795282d6142b6a24c33fb075cd8ec210f27a6cca8a5c9adbe7

    SHA512

    97cebfcdf098621648a46283ae73fa603272c67a95e2cdab6cba1361ec7f7d30f304c16730a73c352f187d519f3901030f81a72d09f328e56edbac33d1d77f4a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    ae96262dd8253f4080c9b2e213c0758c

    SHA1

    6018ad95438ecfa60f51e543c8ba149acf7fdd2a

    SHA256

    e2fb4cf6dddd012b4903256a6165a71803ab02192a61c28518e3007457b295fb

    SHA512

    f7df395c170f988ce0c9b9ee188805eb30863da925dfc5ecc495fd33c033747ae04fc45433828e856937d7eb95343f3141e4f7f1621a64fcb18c1766cb5877dd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07A88C01EC98D34B4BDC2AA2BF874C1D
    Filesize

    480B

    MD5

    984868bd44bf67133a61e29ee44167ee

    SHA1

    00e75911a3354fdf7a31aefcbf1a5fbb770f6031

    SHA256

    f29241f7debb388dd1c013deecbbfbf760defe316da9e8b50172b2e69deb9b5a

    SHA512

    9d79f630a32dd738fefd375c07284eaa6da8c8b43e51c6dd1a62a80ffc47a2159c813f44ff70853bee6772ae0439691c8492db778024e08104d63ea6349f75b5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    df4d54c2de42b3bef2d34f8589563a9c

    SHA1

    9daef99dc504447d6de249964f0537746f0ce3ad

    SHA256

    1f6fc8855fbf86ac7bf91d25eae4b64f2a3614560b23d8b0d281ffe1393bf42d

    SHA512

    580d55629c9c2ff852e56de923455ea3f2690442b4c993d9bf9181a025a45cfc927c5054d0981ab2924943002633b895fc68e97bfbbeca5c6e24eca885a8c328

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f7150d00614c776f493f6651fab9b657

    SHA1

    5f71c48737e3c8b1aa4fa7909d99e323f325db32

    SHA256

    cb2a56811eef7c5042c53802cab5e2a2ee38b4d3ab600309e269218064c8cd14

    SHA512

    e3cc245f9e20a414d31c9bff8107758bb33cb5123cc5803be27fde3ca149f5e79e973a88ce413e6301a9a2da85b46eb2ad48cdd99363df72ac5cba271df60754

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    d0f8463d49b396fc798682a318e91d83

    SHA1

    c7414e6d368140f0f06986350474acd0d6652236

    SHA256

    4db4f51a2c10eb9734977930e9882b95c4729ded08930c68094f1334dd1ffb85

    SHA512

    1879490f9d98ecd2e34e80d6fc2e3b6a33d9b051d705a1027dae62289fb5015e77e1ee8ed91d516089d391e3a748f19d15feaed71b09e77789fc60f5627e4c98

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    ced64e8d4f67be163f57cb88da295a15

    SHA1

    3cc78e222c850769221088afb67e7734bab32283

    SHA256

    338963c6221d2f15c1c75f184d31a869a94801a7adb59175cf4cd72bae8e7c54

    SHA512

    77b857099bcf10edea72a82d87793c144e199789609ceb8c024171796ae6431fb4b4a017b05854efdedc7b730a67c2b5edcb4c00137e80c83c99f022f170767b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    bc534fd1bbe92032740fe0ac1095d259

    SHA1

    aa56cf0d73403b751d83a0892e47ff0d32e5bb69

    SHA256

    c0f9a9ca5ed6bc61cbf5461ce48a10040baf0d606f43856868d25a914c049424

    SHA512

    520aafec7e358615310b42a5ce24e35ec6c135984e18f2e91d8cee1fb508ab498bac98aa950a2fcadac9ec77d37d55fd7367b14c1b0d321ffe0d68e417b9bd20

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab5784.tmp
    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797299\OOLiveUpdateWorker.exe
    Filesize

    3.4MB

    MD5

    a60244c64ce6080a7965d780970e37bd

    SHA1

    e0502440acf407d2a89b440f91d4127be0d7566b

    SHA256

    70a1ccbc632b12e89810717a7b884a964a3a24c14fc43a618564a2f1b17ec0de

    SHA512

    57fd2339b4719e3f45bb114a8e2b10146df6757f4e87b18a2776815c944e5babc594c3ee575bf10dee5dc0b6840534c050c54c4b570dbb6c9369bf2198815086

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797299\OOLiveUpdateWorker.exe
    Filesize

    3.4MB

    MD5

    a60244c64ce6080a7965d780970e37bd

    SHA1

    e0502440acf407d2a89b440f91d4127be0d7566b

    SHA256

    70a1ccbc632b12e89810717a7b884a964a3a24c14fc43a618564a2f1b17ec0de

    SHA512

    57fd2339b4719e3f45bb114a8e2b10146df6757f4e87b18a2776815c944e5babc594c3ee575bf10dee5dc0b6840534c050c54c4b570dbb6c9369bf2198815086

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5816.tmp
    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797299\OOLiveUpdateWorker.exe
    Filesize

    3.4MB

    MD5

    a60244c64ce6080a7965d780970e37bd

    SHA1

    e0502440acf407d2a89b440f91d4127be0d7566b

    SHA256

    70a1ccbc632b12e89810717a7b884a964a3a24c14fc43a618564a2f1b17ec0de

    SHA512

    57fd2339b4719e3f45bb114a8e2b10146df6757f4e87b18a2776815c944e5babc594c3ee575bf10dee5dc0b6840534c050c54c4b570dbb6c9369bf2198815086

    Download Submit