Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
02/11/2023, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.30fe0d9dd8f238e207409b409eef7730.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.30fe0d9dd8f238e207409b409eef7730.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.30fe0d9dd8f238e207409b409eef7730.exe
-
Size
932KB
-
MD5
30fe0d9dd8f238e207409b409eef7730
-
SHA1
72bf3e96dee1627ece25d8b5e487bad21cccbb47
-
SHA256
39aa4fc913ec27566576f3c1e579425eb2204912794a45367d462db1ba5d263a
-
SHA512
3a0a8296e15e2d73ba83f8b72c40717aa95db3d02600f06f1a4fa106a09c24e6eef66f9dbcf23fde89596db6b81f776fc76d1aa836454e7ba41206ae67382922
-
SSDEEP
12288:71/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSd9ThDuqW6C61:71/aGLDCM4D8ayGMZo8/B/W6C6jw2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1148 tahvtl.exe -
Loads dropped DLL 2 IoCs
pid Process 1736 NEAS.30fe0d9dd8f238e207409b409eef7730.exe 1736 NEAS.30fe0d9dd8f238e207409b409eef7730.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\tahvtl.exe" tahvtl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1148 1736 NEAS.30fe0d9dd8f238e207409b409eef7730.exe 28 PID 1736 wrote to memory of 1148 1736 NEAS.30fe0d9dd8f238e207409b409eef7730.exe 28 PID 1736 wrote to memory of 1148 1736 NEAS.30fe0d9dd8f238e207409b409eef7730.exe 28 PID 1736 wrote to memory of 1148 1736 NEAS.30fe0d9dd8f238e207409b409eef7730.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.30fe0d9dd8f238e207409b409eef7730.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.30fe0d9dd8f238e207409b409eef7730.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\ProgramData\tahvtl.exe"C:\ProgramData\tahvtl.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
932KB
MD586c56821a4f84e7f59efc009bf608fe2
SHA175357d7f94f14ddd0793f7c7bec459b827592d8e
SHA25647329884fb32518ca13514cb8bf38aabdf665a48c01dcf3c608e5e9056d24126
SHA51263df5fca9ebd34abb105f74b99bd524078967d7260f84b041518b51fec18894e15618c8cde032d768bfadeed1a6f1d552e2dcb3b6de8714cdfa1675082937cdd
-
Filesize
477KB
MD571e38cb8371fa644436922e0eee6040d
SHA16e9e897cb95fd8434891e87a584f5f1b9482cae2
SHA2562c97f31658ca63791439d384a5c4488bdca89adac6c363c2cc97e5763af30db4
SHA512852954de6ce9732c6533d475ebd22f308c5659690d5197dd5865cde0ef740b40f380035baf8d9e6e38dc0541b5f16ffb01ea1560cbb89528ec4b2214c7fcc3be
-
Filesize
477KB
MD571e38cb8371fa644436922e0eee6040d
SHA16e9e897cb95fd8434891e87a584f5f1b9482cae2
SHA2562c97f31658ca63791439d384a5c4488bdca89adac6c363c2cc97e5763af30db4
SHA512852954de6ce9732c6533d475ebd22f308c5659690d5197dd5865cde0ef740b40f380035baf8d9e6e38dc0541b5f16ffb01ea1560cbb89528ec4b2214c7fcc3be
-
Filesize
454KB
MD5bf070e45aecfc493d0fb0db6c574d736
SHA156e4d235fb65ff3a221ecefa29960419aeb10fec
SHA2563892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35
SHA5125bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822
-
Filesize
454KB
MD5bf070e45aecfc493d0fb0db6c574d736
SHA156e4d235fb65ff3a221ecefa29960419aeb10fec
SHA2563892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35
SHA5125bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822
-
Filesize
454KB
MD5bf070e45aecfc493d0fb0db6c574d736
SHA156e4d235fb65ff3a221ecefa29960419aeb10fec
SHA2563892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35
SHA5125bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822
-
Filesize
454KB
MD5bf070e45aecfc493d0fb0db6c574d736
SHA156e4d235fb65ff3a221ecefa29960419aeb10fec
SHA2563892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35
SHA5125bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822
-
Filesize
454KB
MD5bf070e45aecfc493d0fb0db6c574d736
SHA156e4d235fb65ff3a221ecefa29960419aeb10fec
SHA2563892a3718b6ce6dbcfcb57a33d8c27ad29f0a140290c65da6357e9e2a93a0a35
SHA5125bed670304c855ddf16d223479b82f279e3a13081740ed397bd215c47bc16f0e32fdb1af0ef6e28c6d46bc0f66849a684f8e3ae74dbccb8514c47d471c433822