Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 14:10

General

  • Target

    NEAS.644d40a303585dbab155029e69ca93f0.exe

  • Size

    1.3MB

  • MD5

    644d40a303585dbab155029e69ca93f0

  • SHA1

    36c212c927e22937e8f7d0f0c17d9760d19bccc0

  • SHA256

    65722379adb9a6497e28c5aaed8af37aacc04c5b44c14b538a89091b59ce5ce2

  • SHA512

    f9761d8d750aa5cb5edf54eeda1f59143a18907d30916d6a39751a95c59b172dc7cc208d869f9b15b4949a341f36295a061d9c244b72b9235bc747790ebf6d66

  • SSDEEP

    24576:6wEh5JwhOP7OU8titDdB0DPXytaN+lE2wAdAyq7meznmSFeXGMt/xwCqaLw0IUo:6XSho88RdeitaAKbabXGMtpRNLw0IUo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.644d40a303585dbab155029e69ca93f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.644d40a303585dbab155029e69ca93f0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp
      "C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp"
      2⤵
      • Executes dropped EXE
      PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\sxe8414.tmp

    Filesize

    15KB

    MD5

    bd815b61f9948f93aface4033fbb4423

    SHA1

    b5391484009b39053fc8b1bba63d444969bafcfa

    SHA256

    b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76

    SHA512

    a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71

  • C:\Users\Admin\AppData\Local\Temp\sxe8414.tmp

    Filesize

    15KB

    MD5

    bd815b61f9948f93aface4033fbb4423

    SHA1

    b5391484009b39053fc8b1bba63d444969bafcfa

    SHA256

    b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76

    SHA512

    a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71

  • C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp

    Filesize

    3.8MB

    MD5

    243f215d03ddf12e6821ac05baa421e7

    SHA1

    39b29859050e7929497631c3753e026ded40b38b

    SHA256

    4e061597af4079474ae1e12da8f330d3df5fdce436c24e3acdffe6bbeacb034f

    SHA512

    571af157c208150b37b83ba748898157c0f1d8f7997e623e7f4efd076a7ba0dc2c5c4347b396904469b062f0849ef9411b8bc894dfe495c868622a1c80e7ba09

  • C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp

    Filesize

    3.8MB

    MD5

    243f215d03ddf12e6821ac05baa421e7

    SHA1

    39b29859050e7929497631c3753e026ded40b38b

    SHA256

    4e061597af4079474ae1e12da8f330d3df5fdce436c24e3acdffe6bbeacb034f

    SHA512

    571af157c208150b37b83ba748898157c0f1d8f7997e623e7f4efd076a7ba0dc2c5c4347b396904469b062f0849ef9411b8bc894dfe495c868622a1c80e7ba09