Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    21s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 02:40

General

  • Target

    NEAS.01b5ab450bde6d113d2396f089efe170.exe

  • Size

    708KB

  • MD5

    01b5ab450bde6d113d2396f089efe170

  • SHA1

    d09c5e02107873446e6c77bd3eb168794a1a8cf2

  • SHA256

    7cf15cb30faa87f5ca12ceca72c3634db0d0095422d1ddbffc0804a5d059af71

  • SHA512

    01d84cc377b720e074c929a3e4f25cad97fd856ff709812d6d91047558e258812f29bb6602f11453b4c2bbd00b24edb34ebeb31a6af55cae559a1e62e6d97bc6

  • SSDEEP

    12288:phJ6nTOYREHEpQQJvKPSwvY1fHTHy90w6O:phJ6nTOYKHEpQQJvKPzvYZHTHy7b

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.01b5ab450bde6d113d2396f089efe170.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.01b5ab450bde6d113d2396f089efe170.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\devA14E.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.01b5ab450bde6d113d2396f089efe170.exe! !
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Users\Admin\AppData\Local\Temp\NEAS.01B5AB450BDE6D113D2396F089EFE170.EXE
        3⤵
        • Executes dropped EXE
        PID:3036
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\devA14E.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.01B5AB450BDE6D113D2396F089EFE170.EXE!
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:2292
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\NEAS.01B5AB450BDE6D113D2396F089EFE170.EXE

    Filesize

    708KB

    MD5

    6632fb1b2dae8d43bab638bfbd5ce208

    SHA1

    f45bd0db2eb72bc1b365ccb6cd33be9f9fa79a42

    SHA256

    0a795f84a096fd9bda965a4da44495761fcae7b396a14672715b9317b0759bf7

    SHA512

    d7454bbdd504e134316ee6434806fc3d75fa017cd3d3ca3816dc89964c5ea8434b3c2b97c7299c36d2bd52879489adeafcc203a94936c0182ecb1a5cf7eb92b4

  • C:\Users\Admin\AppData\Local\Temp\NEAS.01B5AB450BDE6D113D2396F089EFE170.EXE

    Filesize

    708KB

    MD5

    6632fb1b2dae8d43bab638bfbd5ce208

    SHA1

    f45bd0db2eb72bc1b365ccb6cd33be9f9fa79a42

    SHA256

    0a795f84a096fd9bda965a4da44495761fcae7b396a14672715b9317b0759bf7

    SHA512

    d7454bbdd504e134316ee6434806fc3d75fa017cd3d3ca3816dc89964c5ea8434b3c2b97c7299c36d2bd52879489adeafcc203a94936c0182ecb1a5cf7eb92b4

  • C:\Users\Admin\AppData\Local\Temp\NEAS.01b5ab450bde6d113d2396f089efe170.exe

    Filesize

    452KB

    MD5

    95b8a4245a6cd37d36e56fae5a23e2b1

    SHA1

    139e0223e64a2d4f7ae94e347c657bdb86dfd5ff

    SHA256

    e69c4abcc4d2f130e66560fc27829b4fe62a2b1f66933790a3060bd7f4fcd878

    SHA512

    9114af555b9d97c87834982c80d9a4a7cc97b8678ed55d96a1a02999b551e9e018d376b404d0925bbb87dcd2aa8e0fa8bf7745f60096a7df01cd918002fb0bf1

  • C:\WINDOWS\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\devA14E.tmp

    Filesize

    452KB

    MD5

    95b8a4245a6cd37d36e56fae5a23e2b1

    SHA1

    139e0223e64a2d4f7ae94e347c657bdb86dfd5ff

    SHA256

    e69c4abcc4d2f130e66560fc27829b4fe62a2b1f66933790a3060bd7f4fcd878

    SHA512

    9114af555b9d97c87834982c80d9a4a7cc97b8678ed55d96a1a02999b551e9e018d376b404d0925bbb87dcd2aa8e0fa8bf7745f60096a7df01cd918002fb0bf1

  • \Users\Admin\AppData\Local\Temp\NEAS.01b5ab450bde6d113d2396f089efe170.exe

    Filesize

    452KB

    MD5

    95b8a4245a6cd37d36e56fae5a23e2b1

    SHA1

    139e0223e64a2d4f7ae94e347c657bdb86dfd5ff

    SHA256

    e69c4abcc4d2f130e66560fc27829b4fe62a2b1f66933790a3060bd7f4fcd878

    SHA512

    9114af555b9d97c87834982c80d9a4a7cc97b8678ed55d96a1a02999b551e9e018d376b404d0925bbb87dcd2aa8e0fa8bf7745f60096a7df01cd918002fb0bf1