Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 14:23
Behavioral task
behavioral1
Sample
NEAS.e960d80b2738ce66dd839ff4720efa20.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.e960d80b2738ce66dd839ff4720efa20.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e960d80b2738ce66dd839ff4720efa20.exe
-
Size
29KB
-
MD5
e960d80b2738ce66dd839ff4720efa20
-
SHA1
8392d8840e686da8080ea79ca5eb41aa19a52ca1
-
SHA256
f1b72ec69e2592c6f3e3dd0e39868df91c29f54a60a9d556825a6e77486802ba
-
SHA512
318a966d1b10c51a64e7b21e70a9c8b69daa6189382a3f2a1588b4bb5e268e182c770840caa0c25e3cc9f547e0fe0be4484668ab64da2ba3de5e68a32fbbe976
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/c:AEwVs+0jNDY1qi/qk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 868 services.exe -
resource yara_rule behavioral2/memory/2160-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x0008000000022da7-4.dat upx behavioral2/memory/868-5-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x0008000000022da7-7.dat upx behavioral2/memory/2160-13-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-15-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/868-16-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/868-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/868-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/868-28-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/868-33-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/868-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x0011000000022dda-43.dat upx behavioral2/memory/2160-82-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-83-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-130-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-140-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-172-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-181-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-232-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-233-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-269-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-270-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-326-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-327-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-373-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-374-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2160-413-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/868-414-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" NEAS.e960d80b2738ce66dd839ff4720efa20.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe NEAS.e960d80b2738ce66dd839ff4720efa20.exe File opened for modification C:\Windows\java.exe NEAS.e960d80b2738ce66dd839ff4720efa20.exe File created C:\Windows\java.exe NEAS.e960d80b2738ce66dd839ff4720efa20.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2160 wrote to memory of 868 2160 NEAS.e960d80b2738ce66dd839ff4720efa20.exe 86 PID 2160 wrote to memory of 868 2160 NEAS.e960d80b2738ce66dd839ff4720efa20.exe 86 PID 2160 wrote to memory of 868 2160 NEAS.e960d80b2738ce66dd839ff4720efa20.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e960d80b2738ce66dd839ff4720efa20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e960d80b2738ce66dd839ff4720efa20.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304B
MD58251fff4df202c8d6dd6aaf34f4838ea
SHA1fa88f08dfdeaff6b86873d447fd26cb7d83a694d
SHA256a17db628f6bdbf4cdc6fe029542404867306406510dbbdb57a047a75ac294962
SHA512e9c0fe2a920377777bdda16a8744cf80d15e1d1b3c94b704f8a4c4cf54d2529ede4aea8a2d6d38f4e3c4d02f602edfed659db6613ac7c374e5214a201f16a3b2
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
305B
MD52c4ce699b73ce3278646321d836aca40
SHA172ead77fbd91cfadae8914cbb4c023a618bf0bd1
SHA256e7391b33aeb3be8afbe1b180430c606c5d3368baf7f458254cef5db9eef966e3
SHA51289ec604cd4a4ad37c5392da0bb28bd9072d731a3efdd38707eeb7b1caf7626e6917da687529bf9426d8eb89fab23175399032d545d96ab93ffd19dd54c02c075
-
Filesize
302B
MD551b86971925c7d24d895ff89fdebc8f5
SHA1d037148e50a77f0de8421e0ef81f87f9f73570da
SHA2563b50a39db6499f5cb2d3b6cec01daa5c33fcf80c0722707c6014e23ed1577280
SHA5121bc88174ee963971ca43e106828d9e74473cf1aa664f6d4fa43ec9631610ab4c1dc9a0c84f5c89dd2b627eaf64f57dee99eca84b88eb14c36bf7285cb9d7f0c4
-
Filesize
303B
MD50a53779b07f9c9c56ef169499851915e
SHA1281bf81610dae812be159f95a0858f88f9b96637
SHA256b946117d346ecf850135aae1ac65b368f4effd806bf5180ecd3c585f1324dbd1
SHA5125a5016dcdeef68be7115eafee0a6844e3cc868fa04f353980d924fca7394962d919d8dece40b15b7ddcc867f956fc8c0e522b68688ca409f1671c39e42973dc6
-
Filesize
304B
MD54d1a10f22e8332513741877c47ac8970
SHA1f68ecc13b7a71e948c6d137be985138586deb726
SHA256a0dbc1b7d129cfa07a5d324fb03e41717fbdd17be3903e7e3fd7f21878dfbba4
SHA5124f1e447c41f5b694bf2bff7f21a73f2bce00dfc844d3c7722ade44249d5ac4b50cf0319630b7f3fdb890bbd76528b6d0ed6b5ad98867d09cd90dcfbfd8b96860
-
Filesize
310B
MD52a8026547dafd0504845f41881ed3ab4
SHA1bedb776ce5eb9d61e602562a926d0fe182d499db
SHA256231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
SHA5121f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
302B
MD53c46188276167b3b8cb0c2e9043a8b8a
SHA1fdbf02d5c5673ee2f52374d34d9e7406219c9787
SHA2566681ad016b8aafa6f1724ac781e0e7c8c8b5eb39ca7c3afed8d2ff4787f178ea
SHA5123be340b703cf982ede8650de50fbbdc397573dfcabd624c998a4136625a35205dae0b787f10a65987d32fdd6d2c61e04e5e50ddb82da5e40d54e6b7fc75e36c9
-
Filesize
304B
MD5605de1f61d0446f81e63c25750e99301
SHA10eaf9121f9dc1338807a511f92ea0b30dc2982a5
SHA256049f75dee036da00f8c8366d29ee14268239df75b8be53aa104aec22b84560f0
SHA512a6a2505b8b89a895922ad6dc06d2ce620cb51cc6582c1b7e498a9f1ee1e4e47c53ebc4f92f8aa37532d558667225e30574732c9fe7187153a262c933893e4285
-
Filesize
256B
MD54996c14a7c4bec10cb1e1595fe0742bf
SHA1cb56ae10b70cd6d4f5128297b34fd639c9dd6273
SHA256345ecd0663e892e8926717720df7a8a17f8f06bb7a3edd3b232cfac889eac106
SHA512e2ad639caa3f21e7b1279a30219e9e87197e5487580a76cb726570c0bd1fa9a8d9edae682cf6b82c446b62cd399ee37750ea9d259ae74770c8b5e8fd70bcc694
-
Filesize
29KB
MD56dfd754cdf5b4bad2a381c2bc3cf4974
SHA1cf41147ee539cff2f7a774963b8ebfd5c8a89630
SHA2568fd2630e5ff0ae74e0e33acc0a570c4e8669c5dd8ca2b5f1061073ddcbeef010
SHA5120c0bb59de9388e77d8fca3ee33f6ecbcd7c207443b7a3888311164345586b9ed740058ef36ecd71fcaae53f7d4deb94fdd6a1cb544da5e38d48b188efd45d1da
-
Filesize
288B
MD5f34aba0ec2bfd8af6dca41612f678286
SHA16f82610313e46300bbcde657acb6f9c060b7bdeb
SHA25604df5f08c949df833527ce93e92117466e3e4e9fc484bcb94b519a4959f7e414
SHA5121037aa92ad1e9a30861bb50cd3156cb96b87bf2c702e4afe6e0b8a78c74f9d4a128110fb8818c072d62116683cb89cea7be3cad7b4aca2dc3e61151a6a7dc0d3
-
Filesize
288B
MD573f81cdfdb87a2b66d1032941d9e21c6
SHA12090a5a6bd568101bb7f9c5bf53062ffd2c37b3e
SHA256323ce28d2fded840c755b51c8cb73c62ede051f9fcc8c39ff2010e2cdd998ea2
SHA5121106afba4821c89ce807bb95d1da7fda86f91aeac7489fb113a1ea2294ccce40b3193af40e2e5f8a4bbe1b5b1078a4070964477534b099bbe4d96c677f6cc349
-
Filesize
288B
MD54e1461d2c6f543c1b2e73c3b446314b9
SHA15d92aec5a1a32f222710d4df3736da480507ef0a
SHA256f5ef6723db7c9c3e185b56fcec24fd1068a2a58afdc9eed509b9457d60a0da92
SHA5123fadd4a8514196834477723b853f23e1e59bd5486692605557089dc837ef9889a9a6c3112e9efc607558b1c22c14961a8c1c034f3ae0dcfd71f7d018b179cb6f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2