Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 20:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe
Resource
win7-20231023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe
-
Size
308KB
-
MD5
012692ba9ae6e441ab0670e35d5d1c20
-
SHA1
fab7e0bbe629916a4421df4760d16665ec87dfb2
-
SHA256
6f77f3ba097b5fd728c73c7d04770e92c047648eaa80d523116fa911de969bde
-
SHA512
8798427c3cee2c912bd845a44032bf8b75548a4f7db44bff441c9fd77cf1acd8149b3cbc59b81a34ca4149544dfb2a8ace2b6ff3f7a0d821d5d1eae640b012f2
-
SSDEEP
6144:hzS49NuYRyIghtsKnvmb7/D26EO/v5WbBX7zZ8RzRNjL6ZkCnbM3F1QSBx8evAZ8:hv/zghtsKnvmb7/D26FWbBX7zZ8RzRNd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qdnes.exe -
Executes dropped EXE 1 IoCs
pid Process 1164 qdnes.exe -
Loads dropped DLL 2 IoCs
pid Process 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /C" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /Y" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /U" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /Z" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /E" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /j" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /R" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /J" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /Q" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /z" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /s" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /l" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /d" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /t" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /P" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /p" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /N" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /O" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /L" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /b" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /M" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /h" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /I" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /f" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /B" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /c" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /u" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /x" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /G" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /w" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /m" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /a" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /v" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /y" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /i" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /K" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /T" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /W" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /o" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /X" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /k" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /r" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /n" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /e" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /F" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /D" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /A" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /S" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /H" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /q" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /s" NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /V" qdnes.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdnes = "C:\\Users\\Admin\\qdnes.exe /g" qdnes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe 1164 qdnes.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 1164 qdnes.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1164 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 28 PID 1768 wrote to memory of 1164 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 28 PID 1768 wrote to memory of 1164 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 28 PID 1768 wrote to memory of 1164 1768 NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.012692ba9ae6e441ab0670e35d5d1c20_JC.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\qdnes.exe"C:\Users\Admin\qdnes.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD5ee76dc4eba5742bffcc6d7bf849297f1
SHA1d92335c21b07b26d13ac47e52862086c7b4e1e5b
SHA256bd33bca2539e947783773d8232a0547c7b9de272e9c29a17a4b75777b52d1be7
SHA5127759ba65a70d9fddbf1a165f328dac108c0e861a20f08bc61cedc4a10834055b5857d7cb979776cd39f625a23f6635f2f39195ecfee1e4469ad90684b4c53063
-
Filesize
308KB
MD5ee76dc4eba5742bffcc6d7bf849297f1
SHA1d92335c21b07b26d13ac47e52862086c7b4e1e5b
SHA256bd33bca2539e947783773d8232a0547c7b9de272e9c29a17a4b75777b52d1be7
SHA5127759ba65a70d9fddbf1a165f328dac108c0e861a20f08bc61cedc4a10834055b5857d7cb979776cd39f625a23f6635f2f39195ecfee1e4469ad90684b4c53063
-
Filesize
308KB
MD5ee76dc4eba5742bffcc6d7bf849297f1
SHA1d92335c21b07b26d13ac47e52862086c7b4e1e5b
SHA256bd33bca2539e947783773d8232a0547c7b9de272e9c29a17a4b75777b52d1be7
SHA5127759ba65a70d9fddbf1a165f328dac108c0e861a20f08bc61cedc4a10834055b5857d7cb979776cd39f625a23f6635f2f39195ecfee1e4469ad90684b4c53063
-
Filesize
308KB
MD5ee76dc4eba5742bffcc6d7bf849297f1
SHA1d92335c21b07b26d13ac47e52862086c7b4e1e5b
SHA256bd33bca2539e947783773d8232a0547c7b9de272e9c29a17a4b75777b52d1be7
SHA5127759ba65a70d9fddbf1a165f328dac108c0e861a20f08bc61cedc4a10834055b5857d7cb979776cd39f625a23f6635f2f39195ecfee1e4469ad90684b4c53063
-
Filesize
308KB
MD5ee76dc4eba5742bffcc6d7bf849297f1
SHA1d92335c21b07b26d13ac47e52862086c7b4e1e5b
SHA256bd33bca2539e947783773d8232a0547c7b9de272e9c29a17a4b75777b52d1be7
SHA5127759ba65a70d9fddbf1a165f328dac108c0e861a20f08bc61cedc4a10834055b5857d7cb979776cd39f625a23f6635f2f39195ecfee1e4469ad90684b4c53063