Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
01/11/2023, 05:40
General
-
Target
NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe
-
Size
7.8MB
-
MD5
a2c45c8e62ba92fdfa2eab67dbf007c0
-
SHA1
f5d1ec34dd92a08a5489a98ad6261d0adf06375b
-
SHA256
17e7243f923b6224f5be5b71b9fc1d2c463b408a2346b54c1acf06f462f201a5
-
SHA512
edb70e771a15471b3d5d6681ef11d356819569ecae6c3d440f58f4b883c47d5447c7cf3ac89989384a8f61e69a167fe6c120025236e0cafbd42058266d45e5d1
-
SSDEEP
196608:9s6co0IoOpxQ4m3/QeV9J/2niyJ+6VrL2qJ3oA:Uojtrm3DV9JGjGqFv
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8P8NE.tmp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.tmp"C:\Users\Admin\AppData\Local\Temp\is-8P8NE.tmp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.tmp" /SL5="$30142,7888651,84992,C:\Users\Admin\AppData\Local\Temp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "DL1028-3"3⤵
-
-
C:\Program Files (x86)\DataLib\DataLib.exe"C:\Program Files (x86)\DataLib\DataLib.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\DataLib\DataLib.exe"C:\Program Files (x86)\DataLib\DataLib.exe" 3c844a93d9b76e9ab91bdbd08fb1d3693⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5302ce91efd12b0921660bd5472217c1f
SHA1ded919c5a3187685344de2e565f4db2fdb699261
SHA2567f4f7a86cc41c16c0ded2ffbc852559857c9510094f192a1f40f0ac60c3ab47c
SHA5129fed53b555b5653f6de25c403593f66cd026dce02cf884b8e3fa9942c03947c53c33639e750d1a82778c6fe0f5e6f77525e35e6cf25785cf7a14490c913c0ff3
-
Filesize
4.9MB
MD5302ce91efd12b0921660bd5472217c1f
SHA1ded919c5a3187685344de2e565f4db2fdb699261
SHA2567f4f7a86cc41c16c0ded2ffbc852559857c9510094f192a1f40f0ac60c3ab47c
SHA5129fed53b555b5653f6de25c403593f66cd026dce02cf884b8e3fa9942c03947c53c33639e750d1a82778c6fe0f5e6f77525e35e6cf25785cf7a14490c913c0ff3
-
Filesize
710KB
MD5cbbf8771d950e9cdaf90c2f51fa89eae
SHA1fec707cb99db603a5af0648b6694195e134b5bf2
SHA25653817a61e53ecf3bd3737f1ade9015b77d274517c8b13e5c35f428a982c000ba
SHA5122f8f08581c18c11a7c706402b1dc82683670176599201b79b9598c68ad19f859bad7e2c3a31769f52e08a7828b5ba5302116309f138d78b405e55967fb509cc6
-
Filesize
710KB
MD5cbbf8771d950e9cdaf90c2f51fa89eae
SHA1fec707cb99db603a5af0648b6694195e134b5bf2
SHA25653817a61e53ecf3bd3737f1ade9015b77d274517c8b13e5c35f428a982c000ba
SHA5122f8f08581c18c11a7c706402b1dc82683670176599201b79b9598c68ad19f859bad7e2c3a31769f52e08a7828b5ba5302116309f138d78b405e55967fb509cc6
-
Filesize
4.9MB
MD5302ce91efd12b0921660bd5472217c1f
SHA1ded919c5a3187685344de2e565f4db2fdb699261
SHA2567f4f7a86cc41c16c0ded2ffbc852559857c9510094f192a1f40f0ac60c3ab47c
SHA5129fed53b555b5653f6de25c403593f66cd026dce02cf884b8e3fa9942c03947c53c33639e750d1a82778c6fe0f5e6f77525e35e6cf25785cf7a14490c913c0ff3
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
710KB
MD5cbbf8771d950e9cdaf90c2f51fa89eae
SHA1fec707cb99db603a5af0648b6694195e134b5bf2
SHA25653817a61e53ecf3bd3737f1ade9015b77d274517c8b13e5c35f428a982c000ba
SHA5122f8f08581c18c11a7c706402b1dc82683670176599201b79b9598c68ad19f859bad7e2c3a31769f52e08a7828b5ba5302116309f138d78b405e55967fb509cc6
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
4KB
-
Filesize
8.9MB
-
Filesize
4KB
-
Filesize
8.9MB
-
Filesize
4KB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
776KB