Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
02/11/2023, 14:04
General
-
Target
NEAS.f2110ab4d6630c812a5428384735be80.exe
-
Size
135KB
-
MD5
f2110ab4d6630c812a5428384735be80
-
SHA1
ad0a630ea8f496e26c09864c255feb6b3c0f06b9
-
SHA256
69d629150b0aef221218b0112ba5693e56bdf02ad1f4ba4bbbdbeecbad1cdd52
-
SHA512
d618acb0d692bfb871a178a9e58bf47380dc5053af3ea288697a5ee64297db6bf7dfff636c6a13df810d8e9e0c3c996487832ed81b7f942e61cc64008e9672dd
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV9i1OFA:UVqoCl/YgjxEufVU0TbTyDDalDZFA
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f2110ab4d6630c812a5428384735be80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f2110ab4d6630c812a5428384735be80.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5c7344acef7fe7ee8959318220b7326e4
SHA19b82b07eeeb3432474be55f50093125857edab7f
SHA256b355a78b9ba14ddfe96e2b4665a219200c0ffff1b5acbe73d39ca320097f5753
SHA512afb0fb22c740dc2a165c5bb2c24e30bc93cb94e732a865583dbbab26e0981cba3799ddd7d9b672f538a04520cf90362a41251e908685bd441616a85dc4c8dd00
-
Filesize
135KB
MD5a8f24ddd49a17a9c993f4649ac77642c
SHA178a26e7c550b50fcab6d58192f0688a8d95091c5
SHA2565baf44ac40f104a3b969e38eb6e21942067595fdc37b3e144b5ef9e3eb8cbd23
SHA5121e6c25aa407d19ddcf43b0281db2f7b78c60a51214ff5f7ac088a1d0894f50349f81bc2780e9669255b65f828d69e29178c64ce936dc0ff036e572380668ace5
-
Filesize
135KB
MD5a8f24ddd49a17a9c993f4649ac77642c
SHA178a26e7c550b50fcab6d58192f0688a8d95091c5
SHA2565baf44ac40f104a3b969e38eb6e21942067595fdc37b3e144b5ef9e3eb8cbd23
SHA5121e6c25aa407d19ddcf43b0281db2f7b78c60a51214ff5f7ac088a1d0894f50349f81bc2780e9669255b65f828d69e29178c64ce936dc0ff036e572380668ace5
-
Filesize
135KB
MD5a8f24ddd49a17a9c993f4649ac77642c
SHA178a26e7c550b50fcab6d58192f0688a8d95091c5
SHA2565baf44ac40f104a3b969e38eb6e21942067595fdc37b3e144b5ef9e3eb8cbd23
SHA5121e6c25aa407d19ddcf43b0281db2f7b78c60a51214ff5f7ac088a1d0894f50349f81bc2780e9669255b65f828d69e29178c64ce936dc0ff036e572380668ace5
-
Filesize
135KB
MD5aa1fc5ad4481674b222bb9e528b58bd6
SHA12317c51d3c77b8bbe0abab3427129a5bb96b800e
SHA25640c57a733db480dfd05878fd1445a4fb27548945c6311bc24471165f58c7238f
SHA512a4db856744d57dcb3c996f109911ab89961edae903326c5edee7255fe885a8b944717c8a74d64ca0971d44095a57973849f5cc74d8e91cc1f50dbfb03c09c516
-
Filesize
135KB
MD5a8f24ddd49a17a9c993f4649ac77642c
SHA178a26e7c550b50fcab6d58192f0688a8d95091c5
SHA2565baf44ac40f104a3b969e38eb6e21942067595fdc37b3e144b5ef9e3eb8cbd23
SHA5121e6c25aa407d19ddcf43b0281db2f7b78c60a51214ff5f7ac088a1d0894f50349f81bc2780e9669255b65f828d69e29178c64ce936dc0ff036e572380668ace5
-
Filesize
135KB
MD5aa1fc5ad4481674b222bb9e528b58bd6
SHA12317c51d3c77b8bbe0abab3427129a5bb96b800e
SHA25640c57a733db480dfd05878fd1445a4fb27548945c6311bc24471165f58c7238f
SHA512a4db856744d57dcb3c996f109911ab89961edae903326c5edee7255fe885a8b944717c8a74d64ca0971d44095a57973849f5cc74d8e91cc1f50dbfb03c09c516
-
Filesize
135KB
MD5c7344acef7fe7ee8959318220b7326e4
SHA19b82b07eeeb3432474be55f50093125857edab7f
SHA256b355a78b9ba14ddfe96e2b4665a219200c0ffff1b5acbe73d39ca320097f5753
SHA512afb0fb22c740dc2a165c5bb2c24e30bc93cb94e732a865583dbbab26e0981cba3799ddd7d9b672f538a04520cf90362a41251e908685bd441616a85dc4c8dd00
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB