Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
01/11/2023, 01:26
General
-
Target
NEAS.68156d8f04892837d48a172104718820.exe
-
Size
484KB
-
MD5
68156d8f04892837d48a172104718820
-
SHA1
1b32108d25ca5ae79153d3e8dc793a9355e61692
-
SHA256
7e59224a8fb8f5fa418327b533fd011a35cd1130a22a51278b1a2a1d765500af
-
SHA512
31af38ae359ed764bb420977f62d687b7041212e9014d26c8244ab6490d30bb15f664bdbf088ea11bf283ea9e7d88d00953ee35264b19abf909533a777d820ec
-
SSDEEP
12288:vLPkCDt1EG2XVekhdeTe30yNE/1R4e7FJL97qepxlk:vLPkQ1bqAG30D/1777LMkxi
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.68156d8f04892837d48a172104718820.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.68156d8f04892837d48a172104718820.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\disksync\SecEtion.exe"C:\Users\Admin\AppData\Roaming\disksync"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~1F0C.tmp3112 496136 2204 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 6243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\ieUnrint.exeC:\Windows\SysWOW64\ieUnrint.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1640 -ip 16401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
484KB
MD53e6c896212a41258c701b8012b12e0da
SHA1efd4492774856c36299d147767d3f756039a2dce
SHA2566161a8a457fcd0f9b6538c742f48a41a2bbe68af33ad746457a821ba55b150d3
SHA512017306876cdb0c5c2f87d180f99c64a7f6406d3298b5dd961a28ae305b8ea870b64b6a7b2cb3f82df2ed6e987b852867750e21a57a8a1d5eacaca25cb3b10095
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
548KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
548KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB