Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2023, 16:41

General

  • Target

    NEAS.30fe0d9dd8f238e207409b409eef7730.exe

  • Size

    932KB

  • MD5

    30fe0d9dd8f238e207409b409eef7730

  • SHA1

    72bf3e96dee1627ece25d8b5e487bad21cccbb47

  • SHA256

    39aa4fc913ec27566576f3c1e579425eb2204912794a45367d462db1ba5d263a

  • SHA512

    3a0a8296e15e2d73ba83f8b72c40717aa95db3d02600f06f1a4fa106a09c24e6eef66f9dbcf23fde89596db6b81f776fc76d1aa836454e7ba41206ae67382922

  • SSDEEP

    12288:71/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSd9ThDuqW6C61:71/aGLDCM4D8ayGMZo8/B/W6C6jw2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.30fe0d9dd8f238e207409b409eef7730.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.30fe0d9dd8f238e207409b409eef7730.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\ProgramData\tahvtl.exe
      "C:\ProgramData\tahvtl.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    932KB

    MD5

    86c56821a4f84e7f59efc009bf608fe2

    SHA1

    75357d7f94f14ddd0793f7c7bec459b827592d8e

    SHA256

    47329884fb32518ca13514cb8bf38aabdf665a48c01dcf3c608e5e9056d24126

    SHA512

    63df5fca9ebd34abb105f74b99bd524078967d7260f84b041518b51fec18894e15618c8cde032d768bfadeed1a6f1d552e2dcb3b6de8714cdfa1675082937cdd

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    71e38cb8371fa644436922e0eee6040d

    SHA1

    6e9e897cb95fd8434891e87a584f5f1b9482cae2

    SHA256

    2c97f31658ca63791439d384a5c4488bdca89adac6c363c2cc97e5763af30db4

    SHA512

    852954de6ce9732c6533d475ebd22f308c5659690d5197dd5865cde0ef740b40f380035baf8d9e6e38dc0541b5f16ffb01ea1560cbb89528ec4b2214c7fcc3be

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    71e38cb8371fa644436922e0eee6040d

    SHA1

    6e9e897cb95fd8434891e87a584f5f1b9482cae2

    SHA256

    2c97f31658ca63791439d384a5c4488bdca89adac6c363c2cc97e5763af30db4

    SHA512

    852954de6ce9732c6533d475ebd22f308c5659690d5197dd5865cde0ef740b40f380035baf8d9e6e38dc0541b5f16ffb01ea1560cbb89528ec4b2214c7fcc3be

  • C:\ProgramData\tahvtl.exe

    Filesize

    454KB

    MD5

    bf070e45aecfc493d0fb0db6c574d736

    SHA1

    56e4d235fb65ff3a221ecefa29960419aeb10fec

    SHA256

    3892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35

    SHA512

    5bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822

  • C:\ProgramData\tahvtl.exe

    Filesize

    454KB

    MD5

    bf070e45aecfc493d0fb0db6c574d736

    SHA1

    56e4d235fb65ff3a221ecefa29960419aeb10fec

    SHA256

    3892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35

    SHA512

    5bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822

  • C:\ProgramData\tahvtl.exe

    Filesize

    454KB

    MD5

    bf070e45aecfc493d0fb0db6c574d736

    SHA1

    56e4d235fb65ff3a221ecefa29960419aeb10fec

    SHA256

    3892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35

    SHA512

    5bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822

  • \ProgramData\tahvtl.exe

    Filesize

    454KB

    MD5

    bf070e45aecfc493d0fb0db6c574d736

    SHA1

    56e4d235fb65ff3a221ecefa29960419aeb10fec

    SHA256

    3892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35

    SHA512

    5bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822

  • \ProgramData\tahvtl.exe

    Filesize

    454KB

    MD5

    bf070e45aecfc493d0fb0db6c574d736

    SHA1

    56e4d235fb65ff3a221ecefa29960419aeb10fec

    SHA256

    3892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35

    SHA512

    5bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822

  • memory/1148-103-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/1148-151-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/1148-217-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/1736-0-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1736-13-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB