Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 14:16

General

  • Target

    NEAS.ab7b1cae52fd4459dbcb7597e6311600.exe

  • Size

    484KB

  • MD5

    ab7b1cae52fd4459dbcb7597e6311600

  • SHA1

    4d57b4c6f09b9251667aaf0716593a6907f964ef

  • SHA256

    05315f6abdc85fa17ff3d20a11ab3cfc2c5c7f026439805e77a89b90d730e6ae

  • SHA512

    71fa98b3a02711c99e5e96300ce02eadf9ec71e9509c1bb1a111ed5a143a8227181131f353456c3fb3b408354bceae70cae8541ee29d6cc2d60dfcc54caca019

  • SSDEEP

    6144:NLTtdYsiZsWnpAwCKCFzEGfuXLZ9U+PhOMUjq+FhBN89psPv0lfWXHIH2pjo132Z:NLPkCDt1EG2XVekhdeTlYeXZjRX4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\NEAS.ab7b1cae52fd4459dbcb7597e6311600.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.ab7b1cae52fd4459dbcb7597e6311600.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Users\Admin\AppData\Roaming\ctfmhost\MRINpugc.exe
        "C:\Users\Admin\AppData\Roaming\ctfmhost"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Users\Admin\AppData\Local\Temp\~45A8.tmp
          1212 495624 1816 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2120
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 252
        3⤵
        • Program crash
        PID:2828
  • C:\Windows\SysWOW64\ktmutvol.exe
    C:\Windows\SysWOW64\ktmutvol.exe -s
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~45A8.tmp

    Filesize

    8KB

    MD5

    aac3165ece2959f39ff98334618d10d9

    SHA1

    020a191bfdc70c1fbd3bf74cd7479258bd197f51

    SHA256

    96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

    SHA512

    9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

  • C:\Users\Admin\AppData\Roaming\ctfmhost\MRINpugc.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • C:\Users\Admin\AppData\Roaming\ctfmhost\MRINpugc.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • C:\Users\Admin\AppData\Roaming\ctfmhost\MRINpugc.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • C:\Windows\SysWOW64\ktmutvol.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • C:\Windows\SysWOW64\ktmutvol.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • \Users\Admin\AppData\Local\Temp\~45A8.tmp

    Filesize

    8KB

    MD5

    aac3165ece2959f39ff98334618d10d9

    SHA1

    020a191bfdc70c1fbd3bf74cd7479258bd197f51

    SHA256

    96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

    SHA512

    9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

  • \Users\Admin\AppData\Roaming\ctfmhost\MRINpugc.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • \Users\Admin\AppData\Roaming\ctfmhost\MRINpugc.exe

    Filesize

    484KB

    MD5

    8c09664d1ed05546798861ece1ba36a6

    SHA1

    4c73a7d0a21709cf6feed8b446d88fa55eaa3818

    SHA256

    ea3da742ccf8138e825ba8bd2294d6f127155b9dbc9697c02485acb338a480a3

    SHA512

    84fe7b2d333e754fca25ea36fec09d6ec57d036be75bda3beeaec27437a5be608f5d688b21a2750451c1c8625f7ecd9cebe33b068ea0596008f5bf6d3c219200

  • memory/1212-22-0x0000000002A30000-0x0000000002A36000-memory.dmp

    Filesize

    24KB

  • memory/1212-24-0x0000000002A40000-0x0000000002A4D000-memory.dmp

    Filesize

    52KB

  • memory/1212-18-0x0000000003DF0000-0x0000000003E79000-memory.dmp

    Filesize

    548KB

  • memory/1212-20-0x0000000003DF0000-0x0000000003E79000-memory.dmp

    Filesize

    548KB

  • memory/1212-17-0x0000000003DF0000-0x0000000003E79000-memory.dmp

    Filesize

    548KB

  • memory/1816-11-0x00000000000E0000-0x0000000000163000-memory.dmp

    Filesize

    524KB

  • memory/1816-13-0x0000000000190000-0x0000000000196000-memory.dmp

    Filesize

    24KB

  • memory/2124-0-0x0000000000220000-0x00000000002A3000-memory.dmp

    Filesize

    524KB

  • memory/2668-31-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2668-30-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2668-29-0x00000000000E0000-0x0000000000163000-memory.dmp

    Filesize

    524KB

  • memory/2668-32-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2668-33-0x00000000000E0000-0x0000000000163000-memory.dmp

    Filesize

    524KB

  • memory/2668-34-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB