Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    168s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 13:50

General

  • Target

    NEAS.0010e671fe10ac9cb12042db8d402550.exe

  • Size

    29KB

  • MD5

    0010e671fe10ac9cb12042db8d402550

  • SHA1

    bd976f109273ed93554ce8ada351f7b17e7dbe90

  • SHA256

    bb78e29beb07d318c0e66231a856a74b722f7f763b4e45e9203a82e07414f721

  • SHA512

    2ec3f073acebb2e54d72d60111708498bdead4cfe9bc76907f3b2e4415e9df7be7f00dc8b95806eb0c916a57ad4c2227cdb0af3e407e7b6738699081383f5a3a

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/O3:AEwVs+0jNDY1qi/qG3

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.0010e671fe10ac9cb12042db8d402550.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.0010e671fe10ac9cb12042db8d402550.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5cd505ffbb33178561a0f1ec5d10cbd9

    SHA1

    8d4c66082394b922416d9da1cd7def9038260435

    SHA256

    078c839fd36ca939904f83633dd73ba6d3433aafac8911a7b0a3458fcb5a977a

    SHA512

    7390ffc6170a8072250138aa620992cd06975b1ae910ec358e8653b1b93c862c06c90d2841bb6fa7c849ec0f194e12b383496fe86f05a72006e2fe4482620a51

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    05e91a42bae902c1a7af18c18091f0ff

    SHA1

    86e936c353105ef6f96b44b1e133f3a8a2b99ce9

    SHA256

    331138b6ebdae9e0ef2ae8f0fc7df886ef60296aa99fd03f463bdbf7de066eb1

    SHA512

    a66192551c0a12378fd6c18239f90d8f7f2f7ea369b5fe8ad3b49e46fe9d6b0edc1ebba38be568e2b62ee0327b856678480e27b193bb05a24f92ea813236f30d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9ed7b12fc8658f0fe34ebd51b5ae1775

    SHA1

    9454119ab33ffd80a6c13d0abcf6a3ccd0ad3d67

    SHA256

    ac47c7737b0709e190dd4a416eb4d77d7da72743a311d0b5109579307b514b07

    SHA512

    b05e2433cc7ccb004237428503d41350ca238dc92c6db8c0be58bd3d0a21ae5892c7406afa022392ff33774877e057165d821a807903aaa9aaf849f4b8e14481

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    830fb34b557dd517cb9c05e35155c638

    SHA1

    5ab0e548ae8be59adf8917deed76467f674fc85e

    SHA256

    565702b087ffd5c158c9a4783d546d4e3f232dfd9fcf3bca4eab5e5c0b48a18a

    SHA512

    d522806ea633081b05a2e5ef4f635cdb1fa7c7727814ec337b0d238279d6cb11c22dcd4aaf6bc8fc11dca5a2c2e40ed9314b5c107993385e1666005375d2ed19

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2WGHIKMU\default[4].htm

    Filesize

    304B

    MD5

    084f55ccad6fddfe1704851a5074a194

    SHA1

    844821de6a0f3c2410341af6b3979f6b59f16a3a

    SHA256

    b10034ade693ec98852ac56ed2b784c546aeb3f11593a7ece687b17c283cb4cf

    SHA512

    776a722ff79b1665f904be9972229f03b67c0a54c9ebb4b639d959e2c87398a3eb5930ebd7c2a03b14ccdbba380ae26ae1ffdbd1f65f8a900fddb4fde467aa31

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2WGHIKMU\default[5].htm

    Filesize

    304B

    MD5

    4d1a10f22e8332513741877c47ac8970

    SHA1

    f68ecc13b7a71e948c6d137be985138586deb726

    SHA256

    a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4

    SHA512

    4f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EN7EZ85X\default[4].htm

    Filesize

    304B

    MD5

    605de1f61d0446f81e63c25750e99301

    SHA1

    0eaf9121f9dc1338807a511f92ea0b30dc2982a5

    SHA256

    049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0

    SHA512

    a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EN7EZ85X\default[5].htm

    Filesize

    305B

    MD5

    2c4ce699b73ce3278646321d836aca40

    SHA1

    72ead77fbd91cfadae8914cbb4c023a618bf0bd1

    SHA256

    e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3

    SHA512

    89ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X62LAKSP\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\4HsxsckepP.log

    Filesize

    256B

    MD5

    c59ede9e5abe1be3a99ddc11de910f90

    SHA1

    55c17671e9998d6e7ac4486bf23bd442811524d0

    SHA256

    4af890fd42e75e6f62f7d1653161db6d252665e10ff6b969a17f8efa5b493ecd

    SHA512

    15ddc0116c5b2a3922326487f35c7340f43f24eadac1f93ddc965e0c9bb6e8ab0af3c91b6b66c7e770ffd93797382a674d24d8f4dcf0e660f65a5d09f2778f6d

  • C:\Users\Admin\AppData\Local\Temp\Cab4658.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar46C8.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Local\Temp\tmp3C93.tmp

    Filesize

    29KB

    MD5

    d1b6c2657fe3aa55da02593b9c252bc5

    SHA1

    0f329551674a40bae4554143fa29baf8cfef1691

    SHA256

    bf71e70516220113a6fc1a6c74ee287cf6dd761bd9a02b1b1cc84953249cf87b

    SHA512

    33817fead2218de42cae2ed1e230220d7d0495e33c7e05dac302425a9e654793221d5bfadc56585fa084d29cb10e805c933e1627f14419e98bf4f31ecf707396

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    fda931516bb2f336bf62fa126c27b9d6

    SHA1

    45e0a14d90201bb5f1958216455cab7aea757398

    SHA256

    b2d44ac67d382f4248aa184e3b40f249eb8f46bddbc9b66f96bbd217afab1f5e

    SHA512

    8de590bfdc41eab5f42e98c7d8d6d070cb39ae4317541df67594a752905614581f4a54a1000a7cfb1dfaa803a871eea603d624b95b77bc4e5211844b24c792a9

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    717042b731834eeae9ed5e7e6ea93d1a

    SHA1

    0b6b4b4bb575f72ca4472f89dbaa78d54391cb44

    SHA256

    a60ede67019afc08d5cc1ff975bc750b71fca7463fc7b47786eaa2504707bdb5

    SHA512

    cfa5e54d4bd098ab103aecfccdb4e8bf00e65eeb3e187cd881e3e200773da4d92f2a9a424452897266f87cf2fd9b8302736789070c4855caa40ebe6ed3a5014e

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2636-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-1188-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-208-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-1846-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-673-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-1779-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-1633-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2636-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3048-207-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-1187-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-17-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB

  • memory/3048-1632-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-21-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB

  • memory/3048-1769-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-672-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-1845-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-16-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3048-4-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB

  • memory/3048-10-0x0000000000230000-0x0000000000238000-memory.dmp

    Filesize

    32KB