Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ec6ebb8ff70702385485c196d5564ef0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.ec6ebb8ff70702385485c196d5564ef0.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.ec6ebb8ff70702385485c196d5564ef0.exe
-
Size
1.4MB
-
MD5
ec6ebb8ff70702385485c196d5564ef0
-
SHA1
e4dfb2a935b11ea5fa25941bebe540de9c6bf950
-
SHA256
ba8476e2079f8791e8e6f90cdfa1d479836605a4acef277ef73fa61a6d5d02d3
-
SHA512
b81b5ad8ef3ed04d38e4c3bfa793d11bc91c20922a2e4050adffac154cabf712f7b8194cd68f9800a562b6f4834eed167746b19ae266a0790be2da7cd1849fa5
-
SSDEEP
12288:/2uHuLs6nYVoXE5amdMdP8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3m:/2uGXmaasqjnhMgeiCl7G0nehbGZpbD
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe NEAS.ec6ebb8ff70702385485c196d5564ef0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3184 NEAS.ec6ebb8ff70702385485c196d5564ef0.exe