Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
02/11/2023, 16:53
General
-
Target
NEAS.fb3173656cd202c4630a572ac23e7310.exe
-
Size
89KB
-
MD5
fb3173656cd202c4630a572ac23e7310
-
SHA1
5784e292bd78955a531d61af1d2c0f875fda5a46
-
SHA256
6a3174b7694b7a4856ad7469060caa7f695e53833a0e8e99d8634f1651309333
-
SHA512
e3f609d7b7544c959da7591a6e413a69e8d31478b24ee1583454d005f1fc411168c7496f0b343e02c554e8bed79cfbf2f9a36e468f4fd687e853391ebb565c95
-
SSDEEP
1536:o6es30MrdpKENdHgjt7dh2Z28IU/WVds2AhO2XEXySOIPywIpIQjNleomXf44yv/:Btp/hNqjt7d228N/75hjEpPynaEURPy3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fb3173656cd202c4630a572ac23e7310.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fb3173656cd202c4630a572ac23e7310.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fb3173656cd202c4630a572ac23e7310.exeC:\Users\Admin\AppData\Local\Temp\NEAS.fb3173656cd202c4630a572ac23e7310.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5d8a9cacf3159be44a49c2139a8e53776
SHA1e553e1f8678a4376a2aede5f4300d39e9e3d4e26
SHA2564668ce4870bb19c0e0467113376b06bebb4384d8f2268765d5e2801a28274028
SHA512a3adb3db15a208e63acfcab277384c0eb1c1aacfae89744bdccc525013e4e5361944f8077ad38e872ef26c7567e7deb425226e70bb37dd0d3ebbda635973420f
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
204KB