Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    161s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 14:16

General

  • Target

    NEAS.ab7b1cae52fd4459dbcb7597e6311600.exe

  • Size

    484KB

  • MD5

    ab7b1cae52fd4459dbcb7597e6311600

  • SHA1

    4d57b4c6f09b9251667aaf0716593a6907f964ef

  • SHA256

    05315f6abdc85fa17ff3d20a11ab3cfc2c5c7f026439805e77a89b90d730e6ae

  • SHA512

    71fa98b3a02711c99e5e96300ce02eadf9ec71e9509c1bb1a111ed5a143a8227181131f353456c3fb3b408354bceae70cae8541ee29d6cc2d60dfcc54caca019

  • SSDEEP

    6144:NLTtdYsiZsWnpAwCKCFzEGfuXLZ9U+PhOMUjq+FhBN89psPv0lfWXHIH2pjo132Z:NLPkCDt1EG2XVekhdeTlYeXZjRX4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3288
    • C:\Users\Admin\AppData\Local\Temp\NEAS.ab7b1cae52fd4459dbcb7597e6311600.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.ab7b1cae52fd4459dbcb7597e6311600.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Users\Admin\AppData\Roaming\RoboHost\expailes.exe
        "C:\Users\Admin\AppData\Roaming\RoboHost"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3240
        • C:\Users\Admin\AppData\Local\Temp\~653D.tmp
          3288 495624 3240 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 608
        3⤵
        • Program crash
        PID:4880
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 608
        3⤵
        • Program crash
        PID:3248
  • C:\Windows\SysWOW64\ARPdiag.exe
    C:\Windows\SysWOW64\ARPdiag.exe -s
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:4032
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1772 -ip 1772
    1⤵
      PID:3064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\~653D.tmp

      Filesize

      8KB

      MD5

      aac3165ece2959f39ff98334618d10d9

      SHA1

      020a191bfdc70c1fbd3bf74cd7479258bd197f51

      SHA256

      96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

      SHA512

      9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

    • C:\Users\Admin\AppData\Local\Temp\~653D.tmp

      Filesize

      8KB

      MD5

      aac3165ece2959f39ff98334618d10d9

      SHA1

      020a191bfdc70c1fbd3bf74cd7479258bd197f51

      SHA256

      96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

      SHA512

      9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

    • C:\Users\Admin\AppData\Roaming\RoboHost\expailes.exe

      Filesize

      484KB

      MD5

      8201f190c61e2ce01d2a0ab7c37a0e12

      SHA1

      89f9410e80d47a1c40b39c25ae6d98e77f7291eb

      SHA256

      7c0d9eb9001d87e262c2c8972bc87e1dc97d754d2bb7df9e8e63121344ffddec

      SHA512

      6f9262149648d69d3fd2e46cf6cb2e61d7399516ea396d8192b04917a7e2822717817b8ab660e5ef426e38024aabf87c92a187c31bd305b2799e77d57ff749ce

    • C:\Users\Admin\AppData\Roaming\RoboHost\expailes.exe

      Filesize

      484KB

      MD5

      8201f190c61e2ce01d2a0ab7c37a0e12

      SHA1

      89f9410e80d47a1c40b39c25ae6d98e77f7291eb

      SHA256

      7c0d9eb9001d87e262c2c8972bc87e1dc97d754d2bb7df9e8e63121344ffddec

      SHA512

      6f9262149648d69d3fd2e46cf6cb2e61d7399516ea396d8192b04917a7e2822717817b8ab660e5ef426e38024aabf87c92a187c31bd305b2799e77d57ff749ce

    • C:\Windows\SysWOW64\ARPdiag.exe

      Filesize

      484KB

      MD5

      8201f190c61e2ce01d2a0ab7c37a0e12

      SHA1

      89f9410e80d47a1c40b39c25ae6d98e77f7291eb

      SHA256

      7c0d9eb9001d87e262c2c8972bc87e1dc97d754d2bb7df9e8e63121344ffddec

      SHA512

      6f9262149648d69d3fd2e46cf6cb2e61d7399516ea396d8192b04917a7e2822717817b8ab660e5ef426e38024aabf87c92a187c31bd305b2799e77d57ff749ce

    • C:\Windows\SysWOW64\ARPdiag.exe

      Filesize

      484KB

      MD5

      8201f190c61e2ce01d2a0ab7c37a0e12

      SHA1

      89f9410e80d47a1c40b39c25ae6d98e77f7291eb

      SHA256

      7c0d9eb9001d87e262c2c8972bc87e1dc97d754d2bb7df9e8e63121344ffddec

      SHA512

      6f9262149648d69d3fd2e46cf6cb2e61d7399516ea396d8192b04917a7e2822717817b8ab660e5ef426e38024aabf87c92a187c31bd305b2799e77d57ff749ce

    • memory/1772-1-0x0000000000860000-0x00000000008E3000-memory.dmp

      Filesize

      524KB

    • memory/1772-0-0x0000000000860000-0x00000000008E3000-memory.dmp

      Filesize

      524KB

    • memory/3240-9-0x00000000007B0000-0x00000000007B6000-memory.dmp

      Filesize

      24KB

    • memory/3240-7-0x0000000000700000-0x0000000000783000-memory.dmp

      Filesize

      524KB

    • memory/3288-15-0x0000000002B70000-0x0000000002BF9000-memory.dmp

      Filesize

      548KB

    • memory/3288-19-0x0000000002B70000-0x0000000002BF9000-memory.dmp

      Filesize

      548KB

    • memory/3288-22-0x0000000002E20000-0x0000000002E26000-memory.dmp

      Filesize

      24KB

    • memory/3288-25-0x0000000002C00000-0x0000000002C0D000-memory.dmp

      Filesize

      52KB

    • memory/4032-16-0x0000000000EA0000-0x0000000000F23000-memory.dmp

      Filesize

      524KB

    • memory/4032-18-0x0000000000FB0000-0x0000000000FB6000-memory.dmp

      Filesize

      24KB

    • memory/4032-23-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

      Filesize

      24KB

    • memory/4032-28-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

      Filesize

      24KB