Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
02/11/2023, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d3361da06cd587144d52d92ad1db72e0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d3361da06cd587144d52d92ad1db72e0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.d3361da06cd587144d52d92ad1db72e0.exe
-
Size
887KB
-
MD5
d3361da06cd587144d52d92ad1db72e0
-
SHA1
0f4b929e7065bb69651ac6c45c127e3064392e78
-
SHA256
a0b31406c25e0533efc68a0cd1023e7bf0b7d2efd7f829d51d1953721ca4b0e1
-
SHA512
2a84c11fd8aa6b38dbd7c9775c12373ce2c04c31c82cb83d763195c21bf279ef162bf3c1e7215fca5e8482d238a1ce3bed755449c44d1b42baf6cdda12cda12e
-
SSDEEP
24576:1D16eB79ccc7cP/bDHHIp04rgZx9A7uDIVzWDJD1QB/1E3U+dmFOJlnC8UcccvXw:1D16eBhccc7cP/bDHHIp04rgZx9A7uDs
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe -
Executes dropped EXE 1 IoCs
pid Process 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe -
Loads dropped DLL 4 IoCs
pid Process 2292 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1708 896 WerFault.exe 29 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2292 NEAS.d3361da06cd587144d52d92ad1db72e0.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2292 wrote to memory of 896 2292 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 29 PID 2292 wrote to memory of 896 2292 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 29 PID 2292 wrote to memory of 896 2292 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 29 PID 2292 wrote to memory of 896 2292 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 29 PID 896 wrote to memory of 1708 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 30 PID 896 wrote to memory of 1708 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 30 PID 896 wrote to memory of 1708 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 30 PID 896 wrote to memory of 1708 896 NEAS.d3361da06cd587144d52d92ad1db72e0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exeC:\Users\Admin\AppData\Local\Temp\NEAS.d3361da06cd587144d52d92ad1db72e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 1443⤵
- Loads dropped DLL
- Program crash
PID:1708
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
887KB
MD59a8a5f15b3c420ec6271f9ab141386e0
SHA1cfb49e240b0cbd9ed8b8b63fcee27e826edc3170
SHA256c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f
SHA512d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea
-
Filesize
887KB
MD59a8a5f15b3c420ec6271f9ab141386e0
SHA1cfb49e240b0cbd9ed8b8b63fcee27e826edc3170
SHA256c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f
SHA512d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea
-
Filesize
887KB
MD59a8a5f15b3c420ec6271f9ab141386e0
SHA1cfb49e240b0cbd9ed8b8b63fcee27e826edc3170
SHA256c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f
SHA512d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea
-
Filesize
887KB
MD59a8a5f15b3c420ec6271f9ab141386e0
SHA1cfb49e240b0cbd9ed8b8b63fcee27e826edc3170
SHA256c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f
SHA512d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea
-
Filesize
887KB
MD59a8a5f15b3c420ec6271f9ab141386e0
SHA1cfb49e240b0cbd9ed8b8b63fcee27e826edc3170
SHA256c9050268883a28d708c9b438c6e5e6f682170f97a100b10c8c57fa577853118f
SHA512d19130f8cf1195d8283cd9a77faeb6d8d3bdb6496c400203012ea67e835a30f44a44fe54cb8c8322bee2e7c78bef946fdf953f19de01c20b7ffaef8cf1743eea