Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 16:42
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
-
Size
896KB
-
MD5
41a7f01f6a2aa59eacafa70d9f8413e0
-
SHA1
34379ee306479cfecd43e88b06f1ec80c81c53d0
-
SHA256
649c1149abc18d368ecbfbd6686d0835b5ee40a1fc81b7fac180426687a6d49b
-
SHA512
11ac5cfd1aa6becbd57915db40c14d9d880275b1004ee4b8354aebfcab51eb21bd08ac7ca932cd15653fe992b7e17d1222d21dde2090ff740a7272d878d0651e
-
SSDEEP
12288:Xy7G7Sok++skWlVijs/92v8j7MjlDa/ZSP:XyK7Fk0Vig/9a8j7Ca/ZSP
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4640 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe -
Executes dropped EXE 1 IoCs
pid Process 4640 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 1212 3076 WerFault.exe 88 116 4640 WerFault.exe 99 1128 4640 WerFault.exe 99 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3076 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4640 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3076 wrote to memory of 4640 3076 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe 99 PID 3076 wrote to memory of 4640 3076 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe 99 PID 3076 wrote to memory of 4640 3076 NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 3482⤵
- Program crash
PID:1212
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exeC:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 3443⤵
- Program crash
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 3483⤵
- Program crash
PID:1128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3076 -ip 30761⤵PID:1020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4640 -ip 46401⤵PID:4692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4640 -ip 46401⤵PID:4500
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD508eadaba9e3a4f447465f40ef85f5710
SHA1cbdf951a3eafbab54b7436de40ba2d41edfae2e1
SHA256efc49674b16ad490a57fb2d320a6d3e5fe8db946040c691fe2c69fc484840b7d
SHA5126e8ea92edfbdf6f3189cebe5b9bc1b2ea7e4bb54331b0eda589ec1b630ef52d1a37189277fec278bff34e1646f8bb9edbab928bf9d1135df6d476f314ce60215