Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 14:25

General

  • Target

    NEAS.ff63fa93084d1cd258752238a5e11c80.exe

  • Size

    2.4MB

  • MD5

    ff63fa93084d1cd258752238a5e11c80

  • SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

  • SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

  • SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • SSDEEP

    49152:48YE4O8b8ITDnlckqeEXGF+6z8zmqtqCK3RTeyay+hviOZ8afQf2Pyn8:Jptrw+6zEmqtqCKkT6OW8

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.ff63fa93084d1cd258752238a5e11c80.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.ff63fa93084d1cd258752238a5e11c80.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2516
    • \??\c:\program files (x86)\mozilla maintenance service\firefoxmaintenanceservice.exe
      "c:\program files (x86)\mozilla maintenance service\firefoxmaintenanceservice.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:1620
    • \??\c:\program files (x86)\microsoft sync framework\v1.0\runtime\x86\synchronizationsynchronization.exe
      "c:\program files (x86)\microsoft sync framework\v1.0\runtime\x86\synchronizationsynchronization.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2316
    • \??\c:\program files (x86)\internet explorer\ieinstalinternet.exe
      "c:\program files (x86)\internet explorer\ieinstalinternet.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2100
    • \??\c:\program files (x86)\windows nt\tabletextservice\fr-fr\windowsmicrosoft.exe
      "c:\program files (x86)\windows nt\tabletextservice\fr-fr\windowsmicrosoft.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Internet Explorer\ieinstalInternet.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\SynchronizationSYNCHRONIZATION.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • C:\Program Files (x86)\Mozilla Maintenance Service\Firefoxmaintenanceservice.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • C:\Program Files (x86)\Mozilla Maintenance Service\Firefoxmaintenanceservice.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\WindowsMicrosoft.exe

    Filesize

    2.4MB

    MD5

    c3f8959e6fcb111f4a484872249d60ad

    SHA1

    a241e2d800ffc3d42e2c9b8168b812ccae150faf

    SHA256

    9bb2f6d7a6c01a9561f4f223ecddee63198e989c1c91c2e43bc889e21c640a55

    SHA512

    30a2bb1a2a850aff28d450474f9c0c2b4ed29ebe70e5def2be6a87ed99bc3e6e07ada9f1a6babae1ffb4cba7bcb44f5790b389397a62daba444536cbf1497f3c

  • C:\Program Files (x86)\Windows NT\TableTextService\fr-FR\WindowsMicrosoft.exe

    Filesize

    2.4MB

    MD5

    c3f8959e6fcb111f4a484872249d60ad

    SHA1

    a241e2d800ffc3d42e2c9b8168b812ccae150faf

    SHA256

    9bb2f6d7a6c01a9561f4f223ecddee63198e989c1c91c2e43bc889e21c640a55

    SHA512

    30a2bb1a2a850aff28d450474f9c0c2b4ed29ebe70e5def2be6a87ed99bc3e6e07ada9f1a6babae1ffb4cba7bcb44f5790b389397a62daba444536cbf1497f3c

  • \Program Files (x86)\Internet Explorer\ieinstalInternet.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • \Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\SynchronizationSYNCHRONIZATION.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • \Program Files (x86)\Mozilla Maintenance Service\Firefoxmaintenanceservice.exe

    Filesize

    2.4MB

    MD5

    ff63fa93084d1cd258752238a5e11c80

    SHA1

    194be21c87c3f83c06160995fb58e97ff4183a66

    SHA256

    9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a

    SHA512

    6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5

  • \Program Files (x86)\Windows NT\TableTextService\fr-FR\WindowsMicrosoft.exe

    Filesize

    2.4MB

    MD5

    c3f8959e6fcb111f4a484872249d60ad

    SHA1

    a241e2d800ffc3d42e2c9b8168b812ccae150faf

    SHA256

    9bb2f6d7a6c01a9561f4f223ecddee63198e989c1c91c2e43bc889e21c640a55

    SHA512

    30a2bb1a2a850aff28d450474f9c0c2b4ed29ebe70e5def2be6a87ed99bc3e6e07ada9f1a6babae1ffb4cba7bcb44f5790b389397a62daba444536cbf1497f3c