Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
02/11/2023, 16:36
General
-
Target
NEAS.79a1b90431319340535a9f40dba9ef90.exe
-
Size
135KB
-
MD5
79a1b90431319340535a9f40dba9ef90
-
SHA1
5ffccde270c41685f714add89d5555ae88519aac
-
SHA256
84fd0df9d663923def1df601513a04eb15dcb2ff900da32848e2399f27a6a6b1
-
SHA512
ae0eec8f1fee12618eb71467fd7c5ffca5a62ab4a676836cfb22b83a25dc8e72c05da3dbcf342044adc1bccd10e646352f1f8201aa94d0fdb0e72ae16ee47796
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXH:UVqoCl/YgjxEufVU0TbTyDDalRH
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.79a1b90431319340535a9f40dba9ef90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.79a1b90431319340535a9f40dba9ef90.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD57b977e8d9af088f5e6ac20fb4120a91c
SHA1a82378edc475dd6258a40a4de52640f8e69bb8ef
SHA25699298446873f7d7633749b37606b57137fd68be492f5896865aeff3c6bde06c0
SHA5125b8761b9f12ee05b350085951011b6e60994c0a51a21a1ea81f9aa0834418af3474285510af8f11b971ba0e88fd254e9ab423e7847815486e6e9d4e4b4dbf1a8
-
Filesize
135KB
MD5b3d941b0fae662c6f10b436798ccfaa4
SHA1494db5ccd2a239928c51b449cbdbb9c38cbf476e
SHA25646aca7341eb336e693be5eee570a6609065ae8ce28ec4f0b609374f9a2507a83
SHA5128e8a5f144ff6d3f05bde278abd0c41265db0f6e103cfc542bb8cb93304462a829a6e525590e26595441d4b81d6ab6ed5a85d02ebff3b9def83ee4b868e727be4
-
Filesize
135KB
MD5b3d941b0fae662c6f10b436798ccfaa4
SHA1494db5ccd2a239928c51b449cbdbb9c38cbf476e
SHA25646aca7341eb336e693be5eee570a6609065ae8ce28ec4f0b609374f9a2507a83
SHA5128e8a5f144ff6d3f05bde278abd0c41265db0f6e103cfc542bb8cb93304462a829a6e525590e26595441d4b81d6ab6ed5a85d02ebff3b9def83ee4b868e727be4
-
Filesize
135KB
MD5b3d941b0fae662c6f10b436798ccfaa4
SHA1494db5ccd2a239928c51b449cbdbb9c38cbf476e
SHA25646aca7341eb336e693be5eee570a6609065ae8ce28ec4f0b609374f9a2507a83
SHA5128e8a5f144ff6d3f05bde278abd0c41265db0f6e103cfc542bb8cb93304462a829a6e525590e26595441d4b81d6ab6ed5a85d02ebff3b9def83ee4b868e727be4
-
Filesize
135KB
MD55b2d8044c4f6742c3b74ee071f055e1a
SHA1e4bf02f1b98c65ad9ac605bc336ac35826d2da3c
SHA2566aa0259be1f1422402cc03d22f8d092ee1db1755c78f66a407179988997852df
SHA512722dd0c3891bba76c0f20fe279eb352d83667aa649cd375d446ef3c55fe71844976e1bcb3d6696fd6d94240791d7e6e7064f2cc7a5485ed9cb2b7648ef6c70d3
-
Filesize
135KB
MD5b3d941b0fae662c6f10b436798ccfaa4
SHA1494db5ccd2a239928c51b449cbdbb9c38cbf476e
SHA25646aca7341eb336e693be5eee570a6609065ae8ce28ec4f0b609374f9a2507a83
SHA5128e8a5f144ff6d3f05bde278abd0c41265db0f6e103cfc542bb8cb93304462a829a6e525590e26595441d4b81d6ab6ed5a85d02ebff3b9def83ee4b868e727be4
-
Filesize
135KB
MD55b2d8044c4f6742c3b74ee071f055e1a
SHA1e4bf02f1b98c65ad9ac605bc336ac35826d2da3c
SHA2566aa0259be1f1422402cc03d22f8d092ee1db1755c78f66a407179988997852df
SHA512722dd0c3891bba76c0f20fe279eb352d83667aa649cd375d446ef3c55fe71844976e1bcb3d6696fd6d94240791d7e6e7064f2cc7a5485ed9cb2b7648ef6c70d3
-
Filesize
135KB
MD57b977e8d9af088f5e6ac20fb4120a91c
SHA1a82378edc475dd6258a40a4de52640f8e69bb8ef
SHA25699298446873f7d7633749b37606b57137fd68be492f5896865aeff3c6bde06c0
SHA5125b8761b9f12ee05b350085951011b6e60994c0a51a21a1ea81f9aa0834418af3474285510af8f11b971ba0e88fd254e9ab423e7847815486e6e9d4e4b4dbf1a8
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB