Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 13:57
Behavioral task
behavioral1
Sample
NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
-
Size
81KB
-
MD5
39583aadabfb02ae5ca2430bfdb549d0
-
SHA1
67e27bef561e5a6b1eb33ddc5d393d6f1b69b165
-
SHA256
bfba02180790f3e7300dc179edf42f11c15a29d9b41bc87b414127d60c682530
-
SHA512
74f894a9a70e5cff287a66646f85eae7fc1c3c5e3ddca4dbdbbca6335f14659077eed4a308a8013833c3683d5c515af6164a6bb0d535bb9d8d0c896db0a406a0
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSWfyjs6AbGRix:5JjcF8KfCOcjk+guPVjSXs6v4
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4456-0-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/files/0x0006000000022df1-6.dat upx behavioral2/memory/4456-29-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe -
Drops file in System32 directory 28 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\hot anita blonde doing lesbo.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\sexy fucked tranny babe.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\honies letting dudes flush mouths full of hot cum.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\schoolgirl deep sucking some cock.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\beautiful blonde gettin an anal fucking.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\this really wild insane groupsex.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\blonde sucking and fucks outdoor.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\winxcfg.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\gay blades in the army.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\chick weeing in her pants.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\hotmailhacker.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\aol password cracker.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\momma's juggs that make you scream for mercy.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\two teenie boppers learning to eat pussy.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\an older fat mom spreading wide.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\tight anal fucking like you want it.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\old man fucking young blonde teen.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\an asian bush getting a cum bath.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\babe enjoys juicy cumshot.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe File created C:\Windows\SysWOW64\macromd\teen babe taken a shower.mpg.pif NEAS.39583aadabfb02ae5ca2430bfdb549d0.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD531b62acf4d60cc294be85d5c9a4f2902
SHA1cb3eb4bd19e3a78ca1c596be16db53c99a99d4ea
SHA2568859d36666677e9f53f0ba75f5e83b4c6d937b716b2ef12d0f735eb4a6b0b813
SHA512fdb3d861cea44a443eeff095a704a52bf71e8cabfc8b1e0a376ee7a9ee444c7dbd17bff9c4a9580cdb14ce46d59c4f536bba3eec594bfe40fa5bbdb1b9e9b365