Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
-
Size
1.2MB
-
MD5
c6b5e1e08854161eff9c75247bbb9de0
-
SHA1
32444db9eaba072b09446330e1d99014f8d97e97
-
SHA256
3c52b42cf7005f0a9091e2dd0b1b3cd41d35c8b469252d4519553e81a16a56bd
-
SHA512
14f8f92ff504b32b6bf753582dadea484579a74d0f4bcf3da970ba04ee2968f9d8578e0d5bed91683a262925d1ec4bc45972ceff77482ff66f677f361783ce9c
-
SSDEEP
24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKeJ0xViDJOVH7Ruz:7z6qaakjC+3srLAKB61bQd3Kea0JOZ7W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2456 bmtqtgjh.exe -
Loads dropped DLL 1 IoCs
pid Process 2164 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2456 2164 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 28 PID 2164 wrote to memory of 2456 2164 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 28 PID 2164 wrote to memory of 2456 2164 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 28 PID 2164 wrote to memory of 2456 2164 NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe"C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe"2⤵
- Executes dropped EXE
PID:2456
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5bc34e95e57cf74fb1f8d425b037427a7
SHA13603b412db9250d0b814885ea3f123f1b4f6c5b9
SHA256eba52648753aa0a3e29dec1daafa94e2583126475f7dea5b30628a834512fc01
SHA512b39f4ef490dbba6c296ffe2426985d986d857addf3f8c4920dae6aa36a2cb69d8126ee4ad2db9509ca109ab0c95cc2a7aeeab1304733739fac336762bf1e9e5c
-
Filesize
1.3MB
MD5bc34e95e57cf74fb1f8d425b037427a7
SHA13603b412db9250d0b814885ea3f123f1b4f6c5b9
SHA256eba52648753aa0a3e29dec1daafa94e2583126475f7dea5b30628a834512fc01
SHA512b39f4ef490dbba6c296ffe2426985d986d857addf3f8c4920dae6aa36a2cb69d8126ee4ad2db9509ca109ab0c95cc2a7aeeab1304733739fac336762bf1e9e5c