Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe
-
Size
209KB
-
MD5
da17f83d947f741ec61df2a41182b1d0
-
SHA1
c62ed6ecf822fa1cbd194577b644fcaa4129d34e
-
SHA256
aa723f86bd0a2ba235b7422e8956ec88a6b0eb389d43e919875253b9e0465d52
-
SHA512
478f82cab4cc9a7be3f9bc05daab88f41355ac485bef702ee6ce6470871677ad55ada018b675590caa0e3925940b0b59390a5d2d683777d0ce7393cfad003ccb
-
SSDEEP
3072:rQcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:rQh9tVRm2kh34hdeCkcG7DEALLlnN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4724 svchost.exe -
resource yara_rule behavioral2/memory/4088-1-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4088-2-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4088-12-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral2/memory/4724-18-0x0000000000400000-0x0000000000469000-memory.dmp upx -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\7d9a6ab4 = "C:\\Windows\\apppatch\\svchost.exe" NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\7d9a6ab4 = "C:\\Windows\\apppatch\\svchost.exe" svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe File opened for modification C:\Windows\apppatch\svchost.exe NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4724 svchost.exe 4724 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4088 NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4088 wrote to memory of 4724 4088 NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe 91 PID 4088 wrote to memory of 4724 4088 NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe 91 PID 4088 wrote to memory of 4724 4088 NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.da17f83d947f741ec61df2a41182b1d0_JC.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD55874cd5701ebfcda8d9a73f3d4f73b39
SHA10deae7cb6b71b6982efc5a71a6ebd62d1a0f10fb
SHA256a1166d501fbb8ce23253ebd562a090f3f3a731af5749563d45395894db177b7d
SHA512c5e185ca83ce756d4d4c8298573227df136e01ab78465a69114a39101bd3eccc08cdebc15fc9c4c158b6ad904a6bddf98eb4a3c65f7214e12c2a0920d4cac5b0
-
Filesize
209KB
MD55874cd5701ebfcda8d9a73f3d4f73b39
SHA10deae7cb6b71b6982efc5a71a6ebd62d1a0f10fb
SHA256a1166d501fbb8ce23253ebd562a090f3f3a731af5749563d45395894db177b7d
SHA512c5e185ca83ce756d4d4c8298573227df136e01ab78465a69114a39101bd3eccc08cdebc15fc9c4c158b6ad904a6bddf98eb4a3c65f7214e12c2a0920d4cac5b0
-
Filesize
209KB
MD55874cd5701ebfcda8d9a73f3d4f73b39
SHA10deae7cb6b71b6982efc5a71a6ebd62d1a0f10fb
SHA256a1166d501fbb8ce23253ebd562a090f3f3a731af5749563d45395894db177b7d
SHA512c5e185ca83ce756d4d4c8298573227df136e01ab78465a69114a39101bd3eccc08cdebc15fc9c4c158b6ad904a6bddf98eb4a3c65f7214e12c2a0920d4cac5b0