Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 01:26
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.68156d8f04892837d48a172104718820.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.68156d8f04892837d48a172104718820.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.68156d8f04892837d48a172104718820.exe
-
Size
484KB
-
MD5
68156d8f04892837d48a172104718820
-
SHA1
1b32108d25ca5ae79153d3e8dc793a9355e61692
-
SHA256
7e59224a8fb8f5fa418327b533fd011a35cd1130a22a51278b1a2a1d765500af
-
SHA512
31af38ae359ed764bb420977f62d687b7041212e9014d26c8244ab6490d30bb15f664bdbf088ea11bf283ea9e7d88d00953ee35264b19abf909533a777d820ec
-
SSDEEP
12288:vLPkCDt1EG2XVekhdeTe30yNE/1R4e7FJL97qepxlk:vLPkQ1bqAG30D/1777LMkxi
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2204 SecEtion.exe 5028 ieUnrint.exe 2100 ~1F0C.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gamestnm = "C:\\Users\\Admin\\AppData\\Roaming\\disksync\\SecEtion.exe" NEAS.68156d8f04892837d48a172104718820.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ieUnrint.exe NEAS.68156d8f04892837d48a172104718820.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4860 1640 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2204 SecEtion.exe 2204 SecEtion.exe 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe 3112 Explorer.EXE 3112 Explorer.EXE 5028 ieUnrint.exe 5028 ieUnrint.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3112 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2204 SecEtion.exe Token: SeShutdownPrivilege 3112 Explorer.EXE Token: SeCreatePagefilePrivilege 3112 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3112 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2204 1640 NEAS.68156d8f04892837d48a172104718820.exe 87 PID 1640 wrote to memory of 2204 1640 NEAS.68156d8f04892837d48a172104718820.exe 87 PID 1640 wrote to memory of 2204 1640 NEAS.68156d8f04892837d48a172104718820.exe 87 PID 2204 wrote to memory of 2100 2204 SecEtion.exe 89 PID 2204 wrote to memory of 2100 2204 SecEtion.exe 89 PID 2100 wrote to memory of 3112 2100 ~1F0C.tmp 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\NEAS.68156d8f04892837d48a172104718820.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.68156d8f04892837d48a172104718820.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Roaming\disksync\SecEtion.exe"C:\Users\Admin\AppData\Roaming\disksync"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\~1F0C.tmp3112 496136 2204 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 6243⤵
- Program crash
PID:4860
-
-
-
C:\Windows\SysWOW64\ieUnrint.exeC:\Windows\SysWOW64\ieUnrint.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1640 -ip 16401⤵PID:3508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095