Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.644d40a303585dbab155029e69ca93f0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.644d40a303585dbab155029e69ca93f0.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.644d40a303585dbab155029e69ca93f0.exe
-
Size
1.3MB
-
MD5
644d40a303585dbab155029e69ca93f0
-
SHA1
36c212c927e22937e8f7d0f0c17d9760d19bccc0
-
SHA256
65722379adb9a6497e28c5aaed8af37aacc04c5b44c14b538a89091b59ce5ce2
-
SHA512
f9761d8d750aa5cb5edf54eeda1f59143a18907d30916d6a39751a95c59b172dc7cc208d869f9b15b4949a341f36295a061d9c244b72b9235bc747790ebf6d66
-
SSDEEP
24576:6wEh5JwhOP7OU8titDdB0DPXytaN+lE2wAdAyq7meznmSFeXGMt/xwCqaLw0IUo:6XSho88RdeitaAKbabXGMtpRNLw0IUo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2180 sxe8474.tmp -
Loads dropped DLL 2 IoCs
pid Process 2864 NEAS.644d40a303585dbab155029e69ca93f0.exe 2864 NEAS.644d40a303585dbab155029e69ca93f0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2180 2864 NEAS.644d40a303585dbab155029e69ca93f0.exe 85 PID 2864 wrote to memory of 2180 2864 NEAS.644d40a303585dbab155029e69ca93f0.exe 85 PID 2864 wrote to memory of 2180 2864 NEAS.644d40a303585dbab155029e69ca93f0.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.644d40a303585dbab155029e69ca93f0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.644d40a303585dbab155029e69ca93f0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp"C:\Users\Admin\AppData\Local\Temp\sxe8474.tmp"2⤵
- Executes dropped EXE
PID:2180
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5bd815b61f9948f93aface4033fbb4423
SHA1b5391484009b39053fc8b1bba63d444969bafcfa
SHA256b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76
SHA512a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71
-
Filesize
15KB
MD5bd815b61f9948f93aface4033fbb4423
SHA1b5391484009b39053fc8b1bba63d444969bafcfa
SHA256b018bf9e9f8b6d945e6a2a25984970634884afabc580af2b4e855730520d5d76
SHA512a363abe97b5a44e5d36af859e8d484daffe1d8e321c87969a75d1bfaa4288a5e6be1922a02c6d72937c84e81a79a1c7f6c9f2a44a995cac3f993ed5608afcd71
-
Filesize
3.8MB
MD5243f215d03ddf12e6821ac05baa421e7
SHA139b29859050e7929497631c3753e026ded40b38b
SHA2564e061597af4079474ae1e12da8f330d3df5fdce436c24e3acdffe6bbeacb034f
SHA512571af157c208150b37b83ba748898157c0f1d8f7997e623e7f4efd076a7ba0dc2c5c4347b396904469b062f0849ef9411b8bc894dfe495c868622a1c80e7ba09
-
Filesize
3.8MB
MD5243f215d03ddf12e6821ac05baa421e7
SHA139b29859050e7929497631c3753e026ded40b38b
SHA2564e061597af4079474ae1e12da8f330d3df5fdce436c24e3acdffe6bbeacb034f
SHA512571af157c208150b37b83ba748898157c0f1d8f7997e623e7f4efd076a7ba0dc2c5c4347b396904469b062f0849ef9411b8bc894dfe495c868622a1c80e7ba09