Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.93d0169c877e83f546cffe39f72c36e0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.93d0169c877e83f546cffe39f72c36e0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.93d0169c877e83f546cffe39f72c36e0.exe
-
Size
1.2MB
-
MD5
93d0169c877e83f546cffe39f72c36e0
-
SHA1
541b9c7b8b9a76dd2a72ffaed32b71c9acd31e54
-
SHA256
b09633f6e63b2135aa363390018284dfa2efb50475e3bdcbe4c0cc834894ed2c
-
SHA512
8c9e7d0e3e8252bf763d805f123da9991095c6e7a63a7a9e91718eb513fb9f754ef35af8616067b60ba1fe01f7a85c72499c4334244519e8f9a4e34eed4dd9f2
-
SSDEEP
24576:M51xVcS9in6bxcqbF8fYTOYKbDurSUQNh:MtVcS4neHbyfYTOYKPu/A
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1900 MSWDM.EXE 2628 MSWDM.EXE 1540 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" NEAS.93d0169c877e83f546cffe39f72c36e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" NEAS.93d0169c877e83f546cffe39f72c36e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\dev9878.tmp MSWDM.EXE File created C:\WINDOWS\MSWDM.EXE NEAS.93d0169c877e83f546cffe39f72c36e0.exe File opened for modification C:\Windows\dev9878.tmp NEAS.93d0169c877e83f546cffe39f72c36e0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2628 MSWDM.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2668 wrote to memory of 1900 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 28 PID 2668 wrote to memory of 1900 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 28 PID 2668 wrote to memory of 1900 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 28 PID 2668 wrote to memory of 1900 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 28 PID 2668 wrote to memory of 2628 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 29 PID 2668 wrote to memory of 2628 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 29 PID 2668 wrote to memory of 2628 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 29 PID 2668 wrote to memory of 2628 2668 NEAS.93d0169c877e83f546cffe39f72c36e0.exe 29 PID 2628 wrote to memory of 1540 2628 MSWDM.EXE 30 PID 2628 wrote to memory of 1540 2628 MSWDM.EXE 30 PID 2628 wrote to memory of 1540 2628 MSWDM.EXE 30 PID 2628 wrote to memory of 1540 2628 MSWDM.EXE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.93d0169c877e83f546cffe39f72c36e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.93d0169c877e83f546cffe39f72c36e0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1900
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev9878.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.93d0169c877e83f546cffe39f72c36e0.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev9878.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.93D0169C877E83F546CFFE39F72C36E0.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD547c32ae59e3669fc5338c625ce6e9d4f
SHA1eaca0f14ea10526bcec8286f51eb13459297cb98
SHA256c3d1d9a75bd41c082bbb3e070bbfe02801aa1974230eb16857e288fe1963681a
SHA51245cc81ca388db0f80da73215eef3711d1095837eec6dc0ef3efc115cb170b171bca2b1c38751f3c71d7a7e6c96e478bed7e23f97e573f4ba86869b518cbf4e7e
-
Filesize
1.2MB
MD547c32ae59e3669fc5338c625ce6e9d4f
SHA1eaca0f14ea10526bcec8286f51eb13459297cb98
SHA256c3d1d9a75bd41c082bbb3e070bbfe02801aa1974230eb16857e288fe1963681a
SHA51245cc81ca388db0f80da73215eef3711d1095837eec6dc0ef3efc115cb170b171bca2b1c38751f3c71d7a7e6c96e478bed7e23f97e573f4ba86869b518cbf4e7e
-
Filesize
1.2MB
MD5c746d1dcd448faee36b083b8c00e6fa7
SHA162ae1b659f285b43ba1121ce8032c5a51073b12c
SHA2568f4025b57ebeca9b974ec03f1a7f43fe06421f8aaac8f64cdd7b9c24c98a2813
SHA512184fd6856c2db71f3c62c07af2fc140b9d9d94306f48505d471a46ccab8bd0a0c90da420c8d3b1139de4adc80c92bb684cdd555cecd779be78c04d952dd7d7a7
-
Filesize
1.2MB
MD5c746d1dcd448faee36b083b8c00e6fa7
SHA162ae1b659f285b43ba1121ce8032c5a51073b12c
SHA2568f4025b57ebeca9b974ec03f1a7f43fe06421f8aaac8f64cdd7b9c24c98a2813
SHA512184fd6856c2db71f3c62c07af2fc140b9d9d94306f48505d471a46ccab8bd0a0c90da420c8d3b1139de4adc80c92bb684cdd555cecd779be78c04d952dd7d7a7
-
Filesize
1.2MB
MD5c746d1dcd448faee36b083b8c00e6fa7
SHA162ae1b659f285b43ba1121ce8032c5a51073b12c
SHA2568f4025b57ebeca9b974ec03f1a7f43fe06421f8aaac8f64cdd7b9c24c98a2813
SHA512184fd6856c2db71f3c62c07af2fc140b9d9d94306f48505d471a46ccab8bd0a0c90da420c8d3b1139de4adc80c92bb684cdd555cecd779be78c04d952dd7d7a7
-
Filesize
1.2MB
MD5c746d1dcd448faee36b083b8c00e6fa7
SHA162ae1b659f285b43ba1121ce8032c5a51073b12c
SHA2568f4025b57ebeca9b974ec03f1a7f43fe06421f8aaac8f64cdd7b9c24c98a2813
SHA512184fd6856c2db71f3c62c07af2fc140b9d9d94306f48505d471a46ccab8bd0a0c90da420c8d3b1139de4adc80c92bb684cdd555cecd779be78c04d952dd7d7a7
-
Filesize
1.2MB
MD5c746d1dcd448faee36b083b8c00e6fa7
SHA162ae1b659f285b43ba1121ce8032c5a51073b12c
SHA2568f4025b57ebeca9b974ec03f1a7f43fe06421f8aaac8f64cdd7b9c24c98a2813
SHA512184fd6856c2db71f3c62c07af2fc140b9d9d94306f48505d471a46ccab8bd0a0c90da420c8d3b1139de4adc80c92bb684cdd555cecd779be78c04d952dd7d7a7
-
Filesize
162B
MD5380bbf4d7bdac05d2248b49c4188cd92
SHA1ae83ef83ebe684eab30ab3ca431e4f84994fd60f
SHA256b97278e320af9d3d990703fd1af322e7c4b568a92f6a736149c1648b2f07a7c2
SHA51206fe7a78b558b7581b52f8d65a6a8a62338a429e550c91ad4ba5cc3f445da83ee86b99e5c7dfbd9bbfcc12895215d2a329756dc6b24ef8313f70658abc08db15