Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 05:40

General

  • Target

    NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe

  • Size

    7.8MB

  • MD5

    a2c45c8e62ba92fdfa2eab67dbf007c0

  • SHA1

    f5d1ec34dd92a08a5489a98ad6261d0adf06375b

  • SHA256

    17e7243f923b6224f5be5b71b9fc1d2c463b408a2346b54c1acf06f462f201a5

  • SHA512

    edb70e771a15471b3d5d6681ef11d356819569ecae6c3d440f58f4b883c47d5447c7cf3ac89989384a8f61e69a167fe6c120025236e0cafbd42058266d45e5d1

  • SSDEEP

    196608:9s6co0IoOpxQ4m3/QeV9J/2niyJ+6VrL2qJ3oA:Uojtrm3DV9JGjGqFv

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\is-S89JF.tmp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-S89JF.tmp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.tmp" /SL5="$40202,7888651,84992,C:\Users\Admin\AppData\Local\Temp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN "DL1028-3"
        3⤵
          PID:2952
        • C:\Program Files (x86)\DataLib\DataLib.exe
          "C:\Program Files (x86)\DataLib\DataLib.exe"
          3⤵
          • Executes dropped EXE
          PID:4376
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 848
            4⤵
            • Program crash
            PID:4408
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 960
            4⤵
            • Program crash
            PID:3512
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 944
            4⤵
            • Program crash
            PID:3536
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1104
            4⤵
            • Program crash
            PID:2816
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 140
            4⤵
            • Program crash
            PID:4996
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /Query
          3⤵
            PID:628
          • C:\Program Files (x86)\DataLib\DataLib.exe
            "C:\Program Files (x86)\DataLib\DataLib.exe" 3c844a93d9b76e9ab91bdbd08fb1d369
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1384
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 908
              4⤵
              • Program crash
              PID:560
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 916
              4⤵
              • Program crash
              PID:2504
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 944
              4⤵
              • Program crash
              PID:728
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1032
              4⤵
              • Program crash
              PID:3228
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1188
              4⤵
              • Program crash
              PID:4908
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1220
              4⤵
              • Program crash
              PID:4220
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1252
              4⤵
              • Program crash
              PID:2960
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1352
              4⤵
              • Program crash
              PID:4424
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1364
              4⤵
              • Program crash
              PID:4368
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1360
              4⤵
              • Program crash
              PID:4164
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 1028
              4⤵
              • Program crash
              PID:1624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4376 -ip 4376
        1⤵
          PID:1380
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4376 -ip 4376
          1⤵
            PID:228
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4376 -ip 4376
            1⤵
              PID:1332
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4376 -ip 4376
              1⤵
                PID:3212
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4376 -ip 4376
                1⤵
                  PID:2284
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1384 -ip 1384
                  1⤵
                    PID:4260
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1384 -ip 1384
                    1⤵
                      PID:1340
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1384 -ip 1384
                      1⤵
                        PID:1372
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1384 -ip 1384
                        1⤵
                          PID:3372
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1384 -ip 1384
                          1⤵
                            PID:3956
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1384 -ip 1384
                            1⤵
                              PID:4132
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1384 -ip 1384
                              1⤵
                                PID:1332
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1384 -ip 1384
                                1⤵
                                  PID:3860
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1384 -ip 1384
                                  1⤵
                                    PID:5108
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1384 -ip 1384
                                    1⤵
                                      PID:2804
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1384 -ip 1384
                                      1⤵
                                        PID:728

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\DataLib\DataLib.exe

                                        Filesize

                                        4.9MB

                                        MD5

                                        302ce91efd12b0921660bd5472217c1f

                                        SHA1

                                        ded919c5a3187685344de2e565f4db2fdb699261

                                        SHA256

                                        7f4f7a86cc41c16c0ded2ffbc852559857c9510094f192a1f40f0ac60c3ab47c

                                        SHA512

                                        9fed53b555b5653f6de25c403593f66cd026dce02cf884b8e3fa9942c03947c53c33639e750d1a82778c6fe0f5e6f77525e35e6cf25785cf7a14490c913c0ff3

                                      • C:\Program Files (x86)\DataLib\DataLib.exe

                                        Filesize

                                        4.9MB

                                        MD5

                                        302ce91efd12b0921660bd5472217c1f

                                        SHA1

                                        ded919c5a3187685344de2e565f4db2fdb699261

                                        SHA256

                                        7f4f7a86cc41c16c0ded2ffbc852559857c9510094f192a1f40f0ac60c3ab47c

                                        SHA512

                                        9fed53b555b5653f6de25c403593f66cd026dce02cf884b8e3fa9942c03947c53c33639e750d1a82778c6fe0f5e6f77525e35e6cf25785cf7a14490c913c0ff3

                                      • C:\Users\Admin\AppData\Local\Temp\is-DC2VS.tmp\_isetup\_iscrypt.dll

                                        Filesize

                                        2KB

                                        MD5

                                        a69559718ab506675e907fe49deb71e9

                                        SHA1

                                        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                        SHA256

                                        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                        SHA512

                                        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                      • C:\Users\Admin\AppData\Local\Temp\is-S89JF.tmp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.tmp

                                        Filesize

                                        710KB

                                        MD5

                                        cbbf8771d950e9cdaf90c2f51fa89eae

                                        SHA1

                                        fec707cb99db603a5af0648b6694195e134b5bf2

                                        SHA256

                                        53817a61e53ecf3bd3737f1ade9015b77d274517c8b13e5c35f428a982c000ba

                                        SHA512

                                        2f8f08581c18c11a7c706402b1dc82683670176599201b79b9598c68ad19f859bad7e2c3a31769f52e08a7828b5ba5302116309f138d78b405e55967fb509cc6

                                      • C:\Users\Admin\AppData\Local\Temp\is-S89JF.tmp\NEAS.a2c45c8e62ba92fdfa2eab67dbf007c0.tmp

                                        Filesize

                                        710KB

                                        MD5

                                        cbbf8771d950e9cdaf90c2f51fa89eae

                                        SHA1

                                        fec707cb99db603a5af0648b6694195e134b5bf2

                                        SHA256

                                        53817a61e53ecf3bd3737f1ade9015b77d274517c8b13e5c35f428a982c000ba

                                        SHA512

                                        2f8f08581c18c11a7c706402b1dc82683670176599201b79b9598c68ad19f859bad7e2c3a31769f52e08a7828b5ba5302116309f138d78b405e55967fb509cc6

                                      • memory/1384-184-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/1384-187-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/1384-181-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1384-179-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/1384-176-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1384-175-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/1384-173-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/1464-161-0x0000000000400000-0x000000000041C000-memory.dmp

                                        Filesize

                                        112KB

                                      • memory/1464-1-0x0000000000400000-0x000000000041C000-memory.dmp

                                        Filesize

                                        112KB

                                      • memory/2336-164-0x0000000000400000-0x00000000004C2000-memory.dmp

                                        Filesize

                                        776KB

                                      • memory/2336-163-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2336-178-0x0000000000400000-0x00000000004C2000-memory.dmp

                                        Filesize

                                        776KB

                                      • memory/2336-7-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4376-169-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/4376-165-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/4376-160-0x0000000003A80000-0x0000000003A81000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4376-159-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/4376-158-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB

                                      • memory/4376-157-0x0000000000400000-0x0000000000CE0000-memory.dmp

                                        Filesize

                                        8.9MB