Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1292ab7a751de796aecb133677be10ae_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.1292ab7a751de796aecb133677be10ae_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.1292ab7a751de796aecb133677be10ae_JC.exe
-
Size
24KB
-
MD5
1292ab7a751de796aecb133677be10ae
-
SHA1
b4a50c157e9e1feedec88c699a60b5384a0ef40d
-
SHA256
2d044015413be5dd6b05ff49982d1c54a7c9110eed22a866bfa9e88bdc98fb5a
-
SHA512
c0e96a8becc555085e712586b8828e29f5833069f917f7ac87f8912849fdc3f519ea84d2d0f63cff7bfbf6caab72b08b104bbfcf10a7da34cda6a4a0a9abf9d0
-
SSDEEP
384:E3eVES+/xwGkRKJJkhlM61qmTTMVF9/q5y0:bGS+ZfbJcO8qYoAT
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" NEAS.1292ab7a751de796aecb133677be10ae_JC.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe NEAS.1292ab7a751de796aecb133677be10ae_JC.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1904 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2848 ipconfig.exe 4736 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1904 tasklist.exe Token: SeDebugPrivilege 4736 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4956 NEAS.1292ab7a751de796aecb133677be10ae_JC.exe 4956 NEAS.1292ab7a751de796aecb133677be10ae_JC.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1584 4956 NEAS.1292ab7a751de796aecb133677be10ae_JC.exe 88 PID 4956 wrote to memory of 1584 4956 NEAS.1292ab7a751de796aecb133677be10ae_JC.exe 88 PID 4956 wrote to memory of 1584 4956 NEAS.1292ab7a751de796aecb133677be10ae_JC.exe 88 PID 1584 wrote to memory of 3896 1584 cmd.exe 92 PID 1584 wrote to memory of 3896 1584 cmd.exe 92 PID 1584 wrote to memory of 3896 1584 cmd.exe 92 PID 1584 wrote to memory of 2848 1584 cmd.exe 93 PID 1584 wrote to memory of 2848 1584 cmd.exe 93 PID 1584 wrote to memory of 2848 1584 cmd.exe 93 PID 1584 wrote to memory of 1904 1584 cmd.exe 95 PID 1584 wrote to memory of 1904 1584 cmd.exe 95 PID 1584 wrote to memory of 1904 1584 cmd.exe 95 PID 1584 wrote to memory of 1096 1584 cmd.exe 97 PID 1584 wrote to memory of 1096 1584 cmd.exe 97 PID 1584 wrote to memory of 1096 1584 cmd.exe 97 PID 1096 wrote to memory of 4320 1096 net.exe 98 PID 1096 wrote to memory of 4320 1096 net.exe 98 PID 1096 wrote to memory of 4320 1096 net.exe 98 PID 1584 wrote to memory of 4736 1584 cmd.exe 99 PID 1584 wrote to memory of 4736 1584 cmd.exe 99 PID 1584 wrote to memory of 4736 1584 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1292ab7a751de796aecb133677be10ae_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1292ab7a751de796aecb133677be10ae_JC.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:3896
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2848
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4320
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5572267bc0fa3b0974685a31b57459eb9
SHA187f6045195a17942e80586f776c9260ef879d5d0
SHA256709297da2a82ada3c3e0b254db0538aa6b79e20fe5b3648b0161edd927d30dde
SHA51262329c5b25de88b021fa450f4114072cfdd1c030063e81092f43776baf57149bbb0b08cb5195ed314200b594b00d81bf1966917dc07b491bcea3c18bc2d2970f