Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe
-
Size
436KB
-
MD5
6098b9f68a14d92a37e10b5cf897db17
-
SHA1
420974ecce3f492a3c70a25ba9c0a2413c5836c7
-
SHA256
da399f36c7296508b17cab83b2c669619cca75b4f8afdb9ce93817b66a272afd
-
SHA512
47567adc2510e377d6e27e4a6876d97d9f5319773d39d1f810d9d2ddb0abef8a5df3dbe1fe0cf539841b8454719098b76fce54dd80dcace3db344a8ca7135443
-
SSDEEP
6144:WcNhJgX9z9TB0YRX8nwhKy4K612iXPMX98L6DFuk:phJ6nTOYREYK46zi9lDMk
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1828 MSWDM.EXE 2088 MSWDM.EXE 2812 NEAS.6098B9F68A14D92A37E10B5CF897DB17_JC.EXE 2772 MSWDM.EXE -
Loads dropped DLL 1 IoCs
pid Process 1828 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe File opened for modification C:\Windows\dev7262.tmp NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe File opened for modification C:\Windows\dev7262.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1828 MSWDM.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2088 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 28 PID 1728 wrote to memory of 2088 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 28 PID 1728 wrote to memory of 2088 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 28 PID 1728 wrote to memory of 2088 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 28 PID 1728 wrote to memory of 1828 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 29 PID 1728 wrote to memory of 1828 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 29 PID 1728 wrote to memory of 1828 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 29 PID 1728 wrote to memory of 1828 1728 NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe 29 PID 1828 wrote to memory of 2812 1828 MSWDM.EXE 30 PID 1828 wrote to memory of 2812 1828 MSWDM.EXE 30 PID 1828 wrote to memory of 2812 1828 MSWDM.EXE 30 PID 1828 wrote to memory of 2812 1828 MSWDM.EXE 30 PID 1828 wrote to memory of 2772 1828 MSWDM.EXE 32 PID 1828 wrote to memory of 2772 1828 MSWDM.EXE 32 PID 1828 wrote to memory of 2772 1828 MSWDM.EXE 32 PID 1828 wrote to memory of 2772 1828 MSWDM.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2088
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev7262.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.6098b9f68a14d92a37e10b5cf897db17_JC.exe! !2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\NEAS.6098B9F68A14D92A37E10B5CF897DB17_JC.EXE
- Executes dropped EXE
PID:2812
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev7262.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.6098B9F68A14D92A37E10B5CF897DB17_JC.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5156e7fc2b53239702ea3cf95a00a06a9
SHA1c4fd8034ae255aafdadb92da90ac5e8f4a5d4a0b
SHA256d213b82ab400ffd04799c699b28eab7d35364760e6d477ee19cb2e120a2127a6
SHA51235f83d5b1fc884a83bf55fa9805ec50cb23d103098916cf6a3fac6c2ac196bd39ac113f74f3485f4cdf918b267d91808707f3c75580ba5bec7641722c7bf2054
-
Filesize
436KB
MD5156e7fc2b53239702ea3cf95a00a06a9
SHA1c4fd8034ae255aafdadb92da90ac5e8f4a5d4a0b
SHA256d213b82ab400ffd04799c699b28eab7d35364760e6d477ee19cb2e120a2127a6
SHA51235f83d5b1fc884a83bf55fa9805ec50cb23d103098916cf6a3fac6c2ac196bd39ac113f74f3485f4cdf918b267d91808707f3c75580ba5bec7641722c7bf2054
-
Filesize
180KB
MD5af6cdb55f9e419169b784a59ab1f7fc5
SHA131e3b9d2742eed03c6209a7ff9f7a56a62384b72
SHA25640395ba22b299a55ef82685598efb2fef316a97835d0aea8759274ac3521266c
SHA512cfea00fb62164a790e6f4b9f54e2e6f3975f5e45d0cc5e94b4dbee9d38d6304d3cc970d307842ab9e800bf0597a9f828e22bfb8c0ee8477f79a64230362df4ac
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
180KB
MD5af6cdb55f9e419169b784a59ab1f7fc5
SHA131e3b9d2742eed03c6209a7ff9f7a56a62384b72
SHA25640395ba22b299a55ef82685598efb2fef316a97835d0aea8759274ac3521266c
SHA512cfea00fb62164a790e6f4b9f54e2e6f3975f5e45d0cc5e94b4dbee9d38d6304d3cc970d307842ab9e800bf0597a9f828e22bfb8c0ee8477f79a64230362df4ac
-
Filesize
180KB
MD5af6cdb55f9e419169b784a59ab1f7fc5
SHA131e3b9d2742eed03c6209a7ff9f7a56a62384b72
SHA25640395ba22b299a55ef82685598efb2fef316a97835d0aea8759274ac3521266c
SHA512cfea00fb62164a790e6f4b9f54e2e6f3975f5e45d0cc5e94b4dbee9d38d6304d3cc970d307842ab9e800bf0597a9f828e22bfb8c0ee8477f79a64230362df4ac