Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
182s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
01/11/2023, 14:25
General
-
Target
NEAS.ff63fa93084d1cd258752238a5e11c80.exe
-
Size
2.4MB
-
MD5
ff63fa93084d1cd258752238a5e11c80
-
SHA1
194be21c87c3f83c06160995fb58e97ff4183a66
-
SHA256
9aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a
-
SHA512
6603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5
-
SSDEEP
49152:48YE4O8b8ITDnlckqeEXGF+6z8zmqtqCK3RTeyay+hviOZ8afQf2Pyn8:Jptrw+6zEmqtqCKkT6OW8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 37 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ff63fa93084d1cd258752238a5e11c80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ff63fa93084d1cd258752238a5e11c80.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5e880ab71335393a09dab7c2110f519ff
SHA147ccc55de8691f884631c3955a032c176f736e58
SHA256ba0b0c7e47caccfcdb3f7d3c10fda67cbdfdf9616db1fdbaeb51d691865f096b
SHA5120c2568c34935f7a1db7d0f91e5c71d018a11b792d1dcbbca1f7951722877c6146fc1aae0c53e5a94e021b77cc09d541669a9da98cdbf0cdcadae1aed7e364da3
-
Filesize
2.7MB
MD5ad73adddd8ab931e0fa55ea41b952017
SHA1b6e609533aeed66255d019cf07b9b351bf2e7da2
SHA2565a7e0f3547e0931231b76d2c63ba75e893e24105b7ac240ca54519d18a4f12c8
SHA5121e725246b5ca267b8b9fa93c3785bbf5bcb25cf15a95b9964ecaa46e6b969a85f257d222cef3b7d8e95cfa58fe209ee8090d61d1a02d65974b697663c8b28f8d
-
Filesize
2.4MB
MD53a163551d240222ab078355c66b97044
SHA183c5161a4eb281b65a48da3ce389eff8209cf9ad
SHA2561c06d5a7e2e16c3adfef67fe5f4b7f527029fb2b360ec63de19aaa3ad71149bf
SHA512232305bc5e6e1a13cbcb0b6298335d322f5d67ef547d182dfc79a2463a8c9b5e6504ee8ac0bac630063e984df8458c77dad33624eb7b0034e419e2681cfa0d0a
-
Filesize
2.4MB
MD5e6b97052624e93c1f7b44e386b13440d
SHA1e8dbaf28ef5d85f42eccf7bc9be859ca25df7050
SHA256da14fcc8f3c7f6adbd56418344d0a5bba67f58917595125eee793db4b90e2f2e
SHA5121c0439b6413824cd29043f04b8e6bb71808e42bb265d42784d4ad469cfe9cba31aefa79e9833e5449ab0bae1c61d0571f1e8fbbc8b290a66a80033fed954c9ef
-
Filesize
2.4MB
MD5ff63fa93084d1cd258752238a5e11c80
SHA1194be21c87c3f83c06160995fb58e97ff4183a66
SHA2569aa652e6e3f1568836b53a3329bf33fa8cd2fab103cb13de5e76f71b98fa518a
SHA5126603f44c409cf22adb6e7dfbe860579215339f8bbfe10e43cea173f9aca7636d1d6ea580ceecc3ae7680f7fce704d25df381dc448a58ac4d9cee8192211be3f5