Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

NEAS.d4d14...50.exe

windows7-x64

8

NEAS.d4d14...50.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 00:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.d4d141ea0704cc04fadada66ddfed750.exe

  • Size

    762KB

  • MD5

    d4d141ea0704cc04fadada66ddfed750

  • SHA1

    2225e3e162afe97c2ebf6a0913c65449633c82dd

  • SHA256

    b0b5b720919001a5da434e0c95f49ae165ed7b850498883f6a7d44c2f183fec0

  • SHA512

    2cada0a81ef3e9b2940c410765f4a85688cfa4abf6de982116ad120ffc76fbb20390b7472b961a1cb2207ce4191ae8973b3185def260576dfa968bbc80ef11dc

  • SSDEEP

    12288:XTbrv/fSvjx+pckifiTcnUlEs471tsVSaEVg3V0H9:zSUj4ZtsfEa3V0d

Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 19 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d4d141ea0704cc04fadada66ddfed750.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d4d141ea0704cc04fadada66ddfed750.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797301\OOLiveUpdateWorker.exe
      "C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797301\OOLiveUpdateWorker.exe" -ProgramName "Unknown" -InstalledLocation "C:\Users\Admin\AppData\Local\Temp\\" -WindowRec "367 176"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:756
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A88C01EC98D34B4BDC2AA2BF874C1D
    Filesize

    471B

    MD5

    56d19b2ea2d0d57a1663c264209197a7

    SHA1

    665d657dfe5c760c9362be19177f91de134681c5

    SHA256

    f161561da827369e2e6b7c02d94a08b6a34f4b83a6c46e33fad99147236000f7

    SHA512

    0c8ebf2d758dc71be0170b08c3a905b9d0c048825f06e050a42ae6cbbcefe725b9e919bcd5507cb31ca617c1bec1d064bbf7daa739e53514e4c97f196947d5de

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    2KB

    MD5

    4cf1da8d132d43ab05e3d69f591bf0ec

    SHA1

    1741a8a439dec6e9f991db606da4fc226cf240d4

    SHA256

    2cde1331fa0e4d795282d6142b6a24c33fb075cd8ec210f27a6cca8a5c9adbe7

    SHA512

    97cebfcdf098621648a46283ae73fa603272c67a95e2cdab6cba1361ec7f7d30f304c16730a73c352f187d519f3901030f81a72d09f328e56edbac33d1d77f4a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    ae96262dd8253f4080c9b2e213c0758c

    SHA1

    6018ad95438ecfa60f51e543c8ba149acf7fdd2a

    SHA256

    e2fb4cf6dddd012b4903256a6165a71803ab02192a61c28518e3007457b295fb

    SHA512

    f7df395c170f988ce0c9b9ee188805eb30863da925dfc5ecc495fd33c033747ae04fc45433828e856937d7eb95343f3141e4f7f1621a64fcb18c1766cb5877dd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07A88C01EC98D34B4BDC2AA2BF874C1D
    Filesize

    480B

    MD5

    b86e9a1df3d028b8f31d1bef540fe72f

    SHA1

    c71101995ef4db15d5595ab524c0d7d4036ce2d8

    SHA256

    0d78cf90dac5e4d0f51881561b169f62979bf3340378472f6475956af989c79d

    SHA512

    f143bff0989e6e7c7e8b7a4fc0b2d1fb3cc93fbcc82f2cd201907d465e8c0cd72dac8f420ec0e187bcb7ea4d9a23d7ac73531f0eba81a4fd9a57d3d20edaf2b0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    dc271cdd7ba98ac6000fc3e61d44ad08

    SHA1

    f9de03a8a5428d942cc8f1518b882bf925c08b2e

    SHA256

    cb9bb42659480b87022acd37235cdf106134ca3a0fb1c77df1e8cf6b9d79788c

    SHA512

    47417716cdb7bdb8264187c0cfc0a2dec8e606c75113590cd457f4c5e688cc801f027a6afb83ecb32dce99e94e176e60dfc43ea8a31d8dc4873c35559c5a19d0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    355e3dcf4252eed5b5c052d0197f3321

    SHA1

    3d75c3a6a02fa6e5b65a1ebee0220cd12ac0b626

    SHA256

    fb95ed343579b6fe5a5b42b54f8de89edb81b51a6ff1fcc13c4673ab58e64dd5

    SHA512

    fad1b4e6a179645a67d743717f692ba1f00b8261eb4fe935ac4fd7ed207d1258ba73f4787f0921782453e2f9d62643ea7027ca90da6c515ce4d9b9f6b2d552f2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797301\OOLiveUpdateWorker.exe
    Filesize

    3.4MB

    MD5

    a60244c64ce6080a7965d780970e37bd

    SHA1

    e0502440acf407d2a89b440f91d4127be0d7566b

    SHA256

    70a1ccbc632b12e89810717a7b884a964a3a24c14fc43a618564a2f1b17ec0de

    SHA512

    57fd2339b4719e3f45bb114a8e2b10146df6757f4e87b18a2776815c944e5babc594c3ee575bf10dee5dc0b6840534c050c54c4b570dbb6c9369bf2198815086

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797301\OOLiveUpdateWorker.exe
    Filesize

    3.4MB

    MD5

    a60244c64ce6080a7965d780970e37bd

    SHA1

    e0502440acf407d2a89b440f91d4127be0d7566b

    SHA256

    70a1ccbc632b12e89810717a7b884a964a3a24c14fc43a618564a2f1b17ec0de

    SHA512

    57fd2339b4719e3f45bb114a8e2b10146df6757f4e87b18a2776815c944e5babc594c3ee575bf10dee5dc0b6840534c050c54c4b570dbb6c9369bf2198815086

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\OO Software\OO LiveUpdate\Unknown 1698797301\OOLiveUpdateWorker.exe
    Filesize

    3.4MB

    MD5

    a60244c64ce6080a7965d780970e37bd

    SHA1

    e0502440acf407d2a89b440f91d4127be0d7566b

    SHA256

    70a1ccbc632b12e89810717a7b884a964a3a24c14fc43a618564a2f1b17ec0de

    SHA512

    57fd2339b4719e3f45bb114a8e2b10146df6757f4e87b18a2776815c944e5babc594c3ee575bf10dee5dc0b6840534c050c54c4b570dbb6c9369bf2198815086

    Download Submit