Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
01/11/2023, 14:14
General
-
Target
NEAS.8f387d0b4ba2c50b1b3f4bcc99bd2e80.exe
-
Size
245KB
-
MD5
8f387d0b4ba2c50b1b3f4bcc99bd2e80
-
SHA1
01cc41bd1a10108703441c66ed578893f843f46b
-
SHA256
ee32b1d83763db3ec22f736bc801ce6ffa18e1967ee9ddaa729954cd27ef9dd4
-
SHA512
47a2bb210da2e6e52718da74a4795c3f7b2e6a8f738c5bd788a9609487bbd002b58169670ecd3c55015b5fc26fadb7dd763e0c9591803903a990064b9f8af86a
-
SSDEEP
6144:IqHb79FsJGWFJ9wBDc+g+6Tu//o7GPDAiCUePe+ZUa:IIbJF6j+++g+2sHD3APfU
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8f387d0b4ba2c50b1b3f4bcc99bd2e80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8f387d0b4ba2c50b1b3f4bcc99bd2e80.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\convmsra\net1ider.exe"C:\Users\Admin\AppData\Roaming\convmsra"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~C6AB.tmp3292 250888 1764 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 6403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\bitsider.exeC:\Windows\SysWOW64\bitsider.exe -s1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3148 -ip 31481⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD523894fc3256b2d8845d08035d9d070eb
SHA158ae5851d9af1e19b19ba4f2e222405936634073
SHA256f13c88e7f5f894278318bad44fac1802847f23bed47958a73db0a853734a0355
SHA512ab79f62d0739ee3f5e974472bb6c1d96edbc6bb3e7c5bdd02333b4efeff04d42268d301c79066144c00ccc88162dece5f8002c096bb4ee27773671fd800de55a
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
245KB
MD5ff64c7f4224c710624e7f9d59948c255
SHA19ad43160a9b2ecb9dfc20703ba487554b81d79f8
SHA25652111c1e3ea7fd3388c036acc475f1794a7f39ae4e16aaf82b08070283cf9206
SHA512260dc8f1ae65a155d3c1fe184efeba41f99c75d1e80d5c67451ec0c0da3ac193f9f24529714db33083e34644e515c9f60a87a8bd9cf494b3496c1dced3c607e4
-
Filesize
245KB
MD5ff64c7f4224c710624e7f9d59948c255
SHA19ad43160a9b2ecb9dfc20703ba487554b81d79f8
SHA25652111c1e3ea7fd3388c036acc475f1794a7f39ae4e16aaf82b08070283cf9206
SHA512260dc8f1ae65a155d3c1fe184efeba41f99c75d1e80d5c67451ec0c0da3ac193f9f24529714db33083e34644e515c9f60a87a8bd9cf494b3496c1dced3c607e4
-
Filesize
245KB
MD5ff64c7f4224c710624e7f9d59948c255
SHA19ad43160a9b2ecb9dfc20703ba487554b81d79f8
SHA25652111c1e3ea7fd3388c036acc475f1794a7f39ae4e16aaf82b08070283cf9206
SHA512260dc8f1ae65a155d3c1fe184efeba41f99c75d1e80d5c67451ec0c0da3ac193f9f24529714db33083e34644e515c9f60a87a8bd9cf494b3496c1dced3c607e4
-
Filesize
245KB
MD5ff64c7f4224c710624e7f9d59948c255
SHA19ad43160a9b2ecb9dfc20703ba487554b81d79f8
SHA25652111c1e3ea7fd3388c036acc475f1794a7f39ae4e16aaf82b08070283cf9206
SHA512260dc8f1ae65a155d3c1fe184efeba41f99c75d1e80d5c67451ec0c0da3ac193f9f24529714db33083e34644e515c9f60a87a8bd9cf494b3496c1dced3c607e4
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
24KB
-
Filesize
284KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
308KB
-
Filesize
308KB