Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f80d8fab53ab317d9a20fc3790364700.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.f80d8fab53ab317d9a20fc3790364700.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.f80d8fab53ab317d9a20fc3790364700.exe
-
Size
128KB
-
MD5
f80d8fab53ab317d9a20fc3790364700
-
SHA1
82263444e522557425cf458bbe832b23ed5b754b
-
SHA256
e93503ec0e84d8825a902e6bc01e110e21943bd5e02cc14baa0d8ec8928621aa
-
SHA512
780b09e7f6f807757b3a0c1f2398c886547e542cae7557811dc9769171b15026bf042d2b4246373e172fe49a90b5565719bc88db70c1379082411e2cc8809fec
-
SSDEEP
3072:T6mSfjauPZJ3RlSHWvtFrNWtozsf4tQ6Qo1DHfHPEkI+kJb9bdXt1:BuRJqHWotwsf4GWH8kdkVv
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2640 suvkbwn.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\suvkbwn.exe NEAS.f80d8fab53ab317d9a20fc3790364700.exe File created C:\PROGRA~3\Mozilla\wfwcssm.dll suvkbwn.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2640 2720 taskeng.exe 29 PID 2720 wrote to memory of 2640 2720 taskeng.exe 29 PID 2720 wrote to memory of 2640 2720 taskeng.exe 29 PID 2720 wrote to memory of 2640 2720 taskeng.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f80d8fab53ab317d9a20fc3790364700.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f80d8fab53ab317d9a20fc3790364700.exe"1⤵
- Drops file in Program Files directory
PID:2888
-
C:\Windows\system32\taskeng.exetaskeng.exe {D328821D-ECB1-4693-829D-417C618E4DAC} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\PROGRA~3\Mozilla\suvkbwn.exeC:\PROGRA~3\Mozilla\suvkbwn.exe -tlhykym2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2640
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5c07fc5c55c55c60a2053129503da6ad0
SHA1a73955a12090afae551c9fca2b5d836717dd3e9a
SHA2568e1ff18acc3669d224a95159c640197e8c75c0bcdc971722a0ac5c03147bf952
SHA512e8cc0d3028fb2193503b127e03e288af4a13f03ed2bb5b895b1f3bb4d9a289ba63ecc97b89621332cba3b869f78a0c38a408c4cc58a477627c45be34c5d657d6
-
Filesize
128KB
MD5c07fc5c55c55c60a2053129503da6ad0
SHA1a73955a12090afae551c9fca2b5d836717dd3e9a
SHA2568e1ff18acc3669d224a95159c640197e8c75c0bcdc971722a0ac5c03147bf952
SHA512e8cc0d3028fb2193503b127e03e288af4a13f03ed2bb5b895b1f3bb4d9a289ba63ecc97b89621332cba3b869f78a0c38a408c4cc58a477627c45be34c5d657d6