Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.9489b609e0a08e64019d65a0d382c550.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.9489b609e0a08e64019d65a0d382c550.exe
-
Size
878KB
-
MD5
9489b609e0a08e64019d65a0d382c550
-
SHA1
1f3d23bfd30faabccdc238a4af4e5c5bc69314a3
-
SHA256
c5b92358c3c05791c95917eb70d9fd3237d04049217cbea1a34bb3bd23ac1697
-
SHA512
12479d3b2d9c365216426ff840f457e1dfce30dc53e3395f2d0fedf6bace1096fdc44ed3270820335df141dee686eb241c606952b4a9b392cfa59a7d45c42e87
-
SSDEEP
12288:7C9oST3SMa29AuA87kHCyBjDERuHbUjhUk4uWSegdXLz+KK:7lE3A29Af87kHC0cRu7udXLz+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4928 set thread context of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2124 AppLaunch.exe 2124 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2124 AppLaunch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85 PID 4928 wrote to memory of 2124 4928 NEAS.9489b609e0a08e64019d65a0d382c550.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9489b609e0a08e64019d65a0d382c550.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9489b609e0a08e64019d65a0d382c550.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-