Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 13:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.126d6e9073f8444dcf9560f96dba2e60.exe
Resource
win7-20231023-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.126d6e9073f8444dcf9560f96dba2e60.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
NEAS.126d6e9073f8444dcf9560f96dba2e60.exe
-
Size
328KB
-
MD5
126d6e9073f8444dcf9560f96dba2e60
-
SHA1
23c4585577ebc0f8265775ae9d634dbadea21141
-
SHA256
70ac00b86b91507d96560d4c4785d64fff0f74085a893844289b11f1d99b3bd7
-
SHA512
b38373954450698979d6f1b42a543815681407ffdf1ae9d1d006117a92e7657aaff23a505e1a4c870f14951827775e03f7a12a6a07bc50589ce63778d5835901
-
SSDEEP
6144:yyWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:yCemx0vN3HKGi6sYjJLUGGtedud5tr7
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\2a3e0564.sys NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Possible privilege escalation attempt 4 IoCs
pid Process 2696 takeown.exe 2692 icacls.exe 2468 takeown.exe 2592 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\2a3e0564\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\2a3e0564.sys" NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Deletes itself 1 IoCs
pid Process 2460 cmd.exe -
Modifies file permissions 1 TTPs 4 IoCs
pid Process 2592 icacls.exe 2696 takeown.exe 2692 icacls.exe 2468 takeown.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\midimap.dll NEAS.126d6e9073f8444dcf9560f96dba2e60.exe File created C:\Windows\SysWOW64\ws2tcpip.dll NEAS.126d6e9073f8444dcf9560f96dba2e60.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll NEAS.126d6e9073f8444dcf9560f96dba2e60.exe File created C:\Windows\SysWOW64\wshtcpip.dll NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "JFreB7uF.dll" NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "NEAS.126d6e9073f8444dcf9560f96dba2e60.exe" NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 464 Process not Found 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe Token: SeTakeOwnershipPrivilege 2696 takeown.exe Token: SeTakeOwnershipPrivilege 2468 takeown.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2764 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 31 PID 2800 wrote to memory of 2764 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 31 PID 2800 wrote to memory of 2764 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 31 PID 2800 wrote to memory of 2764 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 31 PID 2764 wrote to memory of 2696 2764 cmd.exe 33 PID 2764 wrote to memory of 2696 2764 cmd.exe 33 PID 2764 wrote to memory of 2696 2764 cmd.exe 33 PID 2764 wrote to memory of 2696 2764 cmd.exe 33 PID 2764 wrote to memory of 2692 2764 cmd.exe 34 PID 2764 wrote to memory of 2692 2764 cmd.exe 34 PID 2764 wrote to memory of 2692 2764 cmd.exe 34 PID 2764 wrote to memory of 2692 2764 cmd.exe 34 PID 2800 wrote to memory of 2452 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 35 PID 2800 wrote to memory of 2452 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 35 PID 2800 wrote to memory of 2452 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 35 PID 2800 wrote to memory of 2452 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 35 PID 2452 wrote to memory of 2468 2452 cmd.exe 37 PID 2452 wrote to memory of 2468 2452 cmd.exe 37 PID 2452 wrote to memory of 2468 2452 cmd.exe 37 PID 2452 wrote to memory of 2468 2452 cmd.exe 37 PID 2452 wrote to memory of 2592 2452 cmd.exe 38 PID 2452 wrote to memory of 2592 2452 cmd.exe 38 PID 2452 wrote to memory of 2592 2452 cmd.exe 38 PID 2452 wrote to memory of 2592 2452 cmd.exe 38 PID 2800 wrote to memory of 2460 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 39 PID 2800 wrote to memory of 2460 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 39 PID 2800 wrote to memory of 2460 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 39 PID 2800 wrote to memory of 2460 2800 NEAS.126d6e9073f8444dcf9560f96dba2e60.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.126d6e9073f8444dcf9560f96dba2e60.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.126d6e9073f8444dcf9560f96dba2e60.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD510391122ff8e2055b00c4440098ebc88
SHA1e3b41199c25a73c7b980e3a73edb6afe51e273f1
SHA256141d15855fefead79a9718421e2da5b7cb6f5f1d23e9c4e27bb8459fcf76afcb
SHA512061a4d4f4c7b00e498d57177ea8eabb54fbb0d1b3220b2e493a3abeed80d491dfad70e3e5d8dae758d21cc69575ca7b8b5d01b406d647d4bd881138fd790a6d7
-
Filesize
181B
MD510391122ff8e2055b00c4440098ebc88
SHA1e3b41199c25a73c7b980e3a73edb6afe51e273f1
SHA256141d15855fefead79a9718421e2da5b7cb6f5f1d23e9c4e27bb8459fcf76afcb
SHA512061a4d4f4c7b00e498d57177ea8eabb54fbb0d1b3220b2e493a3abeed80d491dfad70e3e5d8dae758d21cc69575ca7b8b5d01b406d647d4bd881138fd790a6d7