Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe
-
Size
68KB
-
MD5
34a5bba7c862b83bbf794f29ded2bf90
-
SHA1
363368d3c35b671b7398d81a4dab0827a4513ccc
-
SHA256
cc9c585487e9f0e1a9da06c918b77e79f92345fde96007fcccfc6570af48c135
-
SHA512
5b102f156e916d4e1087b5171b57dd15f365e0bd14713bd911f0396566349308352097bfda1e8156a3491d51497fcd33257a0ff740534c0953b7e56e5c948eb4
-
SSDEEP
1536:f1Tzy48untU8fOMEI3jyYfPiuOgu6j9sEM:NzltUeOsa+u6j9sEM
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1264 wrote to memory of 3056 1264 NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe 29 PID 1264 wrote to memory of 3056 1264 NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe 29 PID 1264 wrote to memory of 3056 1264 NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe 29 PID 1264 wrote to memory of 3056 1264 NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe 29 PID 3056 wrote to memory of 2744 3056 cmd.exe 30 PID 3056 wrote to memory of 2744 3056 cmd.exe 30 PID 3056 wrote to memory of 2744 3056 cmd.exe 30 PID 3056 wrote to memory of 2744 3056 cmd.exe 30 PID 2744 wrote to memory of 2776 2744 iexpress.exe 31 PID 2744 wrote to memory of 2776 2744 iexpress.exe 31 PID 2744 wrote to memory of 2776 2744 iexpress.exe 31 PID 2744 wrote to memory of 2776 2744 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\94A1.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\NEAS.34a5bba7c862b83bbf794f29ded2bf90.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2776
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
68KB
MD5f6b5454c7e37cce3ae497f75ff98a82a
SHA18ef112f7db1c377c5e787c02a9861029aa4f449e
SHA256a57b92c310d2d0e5d7f51675d43240b443d62c49260245074b7a1a8d4e75adab
SHA5120c2d978f5bfd2a215499494b1dd17ce370feee4eb6d05335473c86cca1d9fd61e877e16fe307c13a80dcfe49bbc70db76ffb16bb4c31b292cdb0013cebc8578b
-
Filesize
68KB
MD5f6b5454c7e37cce3ae497f75ff98a82a
SHA18ef112f7db1c377c5e787c02a9861029aa4f449e
SHA256a57b92c310d2d0e5d7f51675d43240b443d62c49260245074b7a1a8d4e75adab
SHA5120c2d978f5bfd2a215499494b1dd17ce370feee4eb6d05335473c86cca1d9fd61e877e16fe307c13a80dcfe49bbc70db76ffb16bb4c31b292cdb0013cebc8578b
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083