Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2023, 01:09

General

  • Target

    NEAS.009237d696b0d5eae7af485b3be8fc60_JC.exe

  • Size

    314KB

  • MD5

    009237d696b0d5eae7af485b3be8fc60

  • SHA1

    3e69f18cf2d972c585e3b1d9d9e18fda215fee60

  • SHA256

    72443b6eea5e66f444c2b0fa11675a59cc0e86e8e84d6e52af7ecb60c42c8217

  • SHA512

    3265358be8196df6bbc3231320bb6061eab79946dcf811416ea7684b58318863d96a9e393cf48c77c77e43c697f7f2808b7373fc490629b604a8bb2fbe2ae66b

  • SSDEEP

    6144:PicUuSwoj6MB8MhjwszeXmr8SeNpgdyuH1lFDjC:PicUuSj6Najb87gP3C

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 16 IoCs
  • Executes dropped EXE 8 IoCs
  • Drops file in System32 directory 24 IoCs
  • Program crash 2 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.009237d696b0d5eae7af485b3be8fc60_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.009237d696b0d5eae7af485b3be8fc60_JC.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\SysWOW64\Agnkck32.exe
      C:\Windows\system32\Agnkck32.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Windows\SysWOW64\Cjomldfp.exe
        C:\Windows\system32\Cjomldfp.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\SysWOW64\Capkim32.exe
          C:\Windows\system32\Capkim32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1160
          • C:\Windows\SysWOW64\Dndlba32.exe
            C:\Windows\system32\Dndlba32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3912
            • C:\Windows\SysWOW64\Daeddlco.exe
              C:\Windows\system32\Daeddlco.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3508
              • C:\Windows\SysWOW64\Djpfbahm.exe
                C:\Windows\system32\Djpfbahm.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4896
                • C:\Windows\SysWOW64\Dbijinfl.exe
                  C:\Windows\system32\Dbijinfl.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:2704
                  • C:\Windows\SysWOW64\Eldlhckj.exe
                    C:\Windows\system32\Eldlhckj.exe
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1040
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 400
                      10⤵
                      • Program crash
                      PID:3472
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 400
                      10⤵
                      • Program crash
                      PID:5036
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1040 -ip 1040
    1⤵
      PID:3556

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Agnkck32.exe

      Filesize

      314KB

      MD5

      7fb7e2c764c9b7f93c092caf16e5042c

      SHA1

      794bd2bb5c13998a11bb684d186ba5b3a851ce9a

      SHA256

      6fdb0f21f9eea7839737cd6b6f29d1be2c71c7e1c0ebd5b4aac2540a11b310f1

      SHA512

      a73198f3308e7f5361a46805e25b9f2c04164ed57854e37fb31095c4bcf32aaed035af4bcb2d1d6ae23801031d83c2a788d78a2aa7ba52fda108185d540ae6fb

    • C:\Windows\SysWOW64\Agnkck32.exe

      Filesize

      314KB

      MD5

      7fb7e2c764c9b7f93c092caf16e5042c

      SHA1

      794bd2bb5c13998a11bb684d186ba5b3a851ce9a

      SHA256

      6fdb0f21f9eea7839737cd6b6f29d1be2c71c7e1c0ebd5b4aac2540a11b310f1

      SHA512

      a73198f3308e7f5361a46805e25b9f2c04164ed57854e37fb31095c4bcf32aaed035af4bcb2d1d6ae23801031d83c2a788d78a2aa7ba52fda108185d540ae6fb

    • C:\Windows\SysWOW64\Capkim32.exe

      Filesize

      314KB

      MD5

      c6533d276749ccfa7e1df59731da3ff8

      SHA1

      4c71801d99853217f02e65f86a529e9ff01e8782

      SHA256

      064940d6897a03187a2922376f0a302f362c003f884420c584561ce04d5f78d3

      SHA512

      132e76d24e241cf8cf013ca26fed62d652235f78f63b52a434794291437cf7c93e8594f9cf2b080fc8a84b11299c6fe0eaec40ca49188a8bd9be6c63af7c8dc0

    • C:\Windows\SysWOW64\Capkim32.exe

      Filesize

      314KB

      MD5

      c6533d276749ccfa7e1df59731da3ff8

      SHA1

      4c71801d99853217f02e65f86a529e9ff01e8782

      SHA256

      064940d6897a03187a2922376f0a302f362c003f884420c584561ce04d5f78d3

      SHA512

      132e76d24e241cf8cf013ca26fed62d652235f78f63b52a434794291437cf7c93e8594f9cf2b080fc8a84b11299c6fe0eaec40ca49188a8bd9be6c63af7c8dc0

    • C:\Windows\SysWOW64\Cjomldfp.exe

      Filesize

      314KB

      MD5

      af1c60fd0407bc78738a4ca42e5ad212

      SHA1

      bf9a93870891275fe34be20b788453e33d708a58

      SHA256

      bda97fba155a1c779a7cc618bc27ae9b4cb07677135abc90a814ea87b8146b9f

      SHA512

      03ab57619256d009653bdbe0faa2e7e1b5333a289aae9d492db7d05f0eab5de8d6b3b08c3bd8a954aac4029a000cd47f7ba5e621e9034d0c15200bbfc28d1e72

    • C:\Windows\SysWOW64\Cjomldfp.exe

      Filesize

      314KB

      MD5

      af1c60fd0407bc78738a4ca42e5ad212

      SHA1

      bf9a93870891275fe34be20b788453e33d708a58

      SHA256

      bda97fba155a1c779a7cc618bc27ae9b4cb07677135abc90a814ea87b8146b9f

      SHA512

      03ab57619256d009653bdbe0faa2e7e1b5333a289aae9d492db7d05f0eab5de8d6b3b08c3bd8a954aac4029a000cd47f7ba5e621e9034d0c15200bbfc28d1e72

    • C:\Windows\SysWOW64\Daeddlco.exe

      Filesize

      314KB

      MD5

      a38c4bdcb259151f1745d6591f84581a

      SHA1

      974082f794a12f787970e41118f7dca196b9c174

      SHA256

      98e9e0ae81f35d243d0b4d416981481aa31fb922881fe881173a7beace2568e2

      SHA512

      7e221b75b2bb3613731c5b168e48320f35110ee81532ed6fa381c8e466b629b2f73c0dccd9613b19fdf79a88255d28b0ce5780ca19c00fd415180c78e1f37902

    • C:\Windows\SysWOW64\Daeddlco.exe

      Filesize

      314KB

      MD5

      a38c4bdcb259151f1745d6591f84581a

      SHA1

      974082f794a12f787970e41118f7dca196b9c174

      SHA256

      98e9e0ae81f35d243d0b4d416981481aa31fb922881fe881173a7beace2568e2

      SHA512

      7e221b75b2bb3613731c5b168e48320f35110ee81532ed6fa381c8e466b629b2f73c0dccd9613b19fdf79a88255d28b0ce5780ca19c00fd415180c78e1f37902

    • C:\Windows\SysWOW64\Dbijinfl.exe

      Filesize

      314KB

      MD5

      b60f7e3f524b81439a46a229174821e1

      SHA1

      d94f0b1b42e9b4a997f509fce38f1c05f625b5a3

      SHA256

      a6809c55fcbd85c5fcf53d6138bb1445a083f024fece3d2f59cabd8bf1508cfc

      SHA512

      0bbbf7239bc048b0ed860e0891be4a3d77bcb9670e771fc11d08d905b836372f82677f7d01025e8182d061e8d394012dc2e3d96512c9f24fee78187990343257

    • C:\Windows\SysWOW64\Dbijinfl.exe

      Filesize

      314KB

      MD5

      b60f7e3f524b81439a46a229174821e1

      SHA1

      d94f0b1b42e9b4a997f509fce38f1c05f625b5a3

      SHA256

      a6809c55fcbd85c5fcf53d6138bb1445a083f024fece3d2f59cabd8bf1508cfc

      SHA512

      0bbbf7239bc048b0ed860e0891be4a3d77bcb9670e771fc11d08d905b836372f82677f7d01025e8182d061e8d394012dc2e3d96512c9f24fee78187990343257

    • C:\Windows\SysWOW64\Djpfbahm.exe

      Filesize

      314KB

      MD5

      a38c4bdcb259151f1745d6591f84581a

      SHA1

      974082f794a12f787970e41118f7dca196b9c174

      SHA256

      98e9e0ae81f35d243d0b4d416981481aa31fb922881fe881173a7beace2568e2

      SHA512

      7e221b75b2bb3613731c5b168e48320f35110ee81532ed6fa381c8e466b629b2f73c0dccd9613b19fdf79a88255d28b0ce5780ca19c00fd415180c78e1f37902

    • C:\Windows\SysWOW64\Djpfbahm.exe

      Filesize

      314KB

      MD5

      e391864e1219a49f8b0c25f797701c3d

      SHA1

      7f82c003ffa06f2b264a21fc6c7a92bcbbb4b359

      SHA256

      248b54557a3320be2d54fe953dbbe57114fd4028c2ca2d2f2085f80076cbf14f

      SHA512

      eb9f71d387dec3893942ed4f88f355c0b604ad8fcd32a8a0d35a3414582f2b53b2a4782811aa4b9aeed16b2dacb9b6b4aea004be488ccbd464cbef5390f40e31

    • C:\Windows\SysWOW64\Djpfbahm.exe

      Filesize

      314KB

      MD5

      e391864e1219a49f8b0c25f797701c3d

      SHA1

      7f82c003ffa06f2b264a21fc6c7a92bcbbb4b359

      SHA256

      248b54557a3320be2d54fe953dbbe57114fd4028c2ca2d2f2085f80076cbf14f

      SHA512

      eb9f71d387dec3893942ed4f88f355c0b604ad8fcd32a8a0d35a3414582f2b53b2a4782811aa4b9aeed16b2dacb9b6b4aea004be488ccbd464cbef5390f40e31

    • C:\Windows\SysWOW64\Dndlba32.exe

      Filesize

      314KB

      MD5

      c6533d276749ccfa7e1df59731da3ff8

      SHA1

      4c71801d99853217f02e65f86a529e9ff01e8782

      SHA256

      064940d6897a03187a2922376f0a302f362c003f884420c584561ce04d5f78d3

      SHA512

      132e76d24e241cf8cf013ca26fed62d652235f78f63b52a434794291437cf7c93e8594f9cf2b080fc8a84b11299c6fe0eaec40ca49188a8bd9be6c63af7c8dc0

    • C:\Windows\SysWOW64\Dndlba32.exe

      Filesize

      314KB

      MD5

      09fc78ad9e33bcd3207e411206444743

      SHA1

      7555e1ba71ba0c19956552d81cb2e0531ef01963

      SHA256

      1752ea5f891fa41a95ec8f41e151d49c207c2bba8d66f666809cd54114d27f9f

      SHA512

      8fb4d556043eff1720fbe883d400ba66b19d40b3d4e80189b5400306f2ad7ac8fd61e41bdb551cff6f5e627bb49e749535e37d608213fe01cd4d4b724b0f600a

    • C:\Windows\SysWOW64\Dndlba32.exe

      Filesize

      314KB

      MD5

      09fc78ad9e33bcd3207e411206444743

      SHA1

      7555e1ba71ba0c19956552d81cb2e0531ef01963

      SHA256

      1752ea5f891fa41a95ec8f41e151d49c207c2bba8d66f666809cd54114d27f9f

      SHA512

      8fb4d556043eff1720fbe883d400ba66b19d40b3d4e80189b5400306f2ad7ac8fd61e41bdb551cff6f5e627bb49e749535e37d608213fe01cd4d4b724b0f600a

    • C:\Windows\SysWOW64\Eldlhckj.exe

      Filesize

      314KB

      MD5

      60de038dbe27c81d4d345e241171059a

      SHA1

      5061dd9f07e4d1fab7914a4a2935a7d9297647bc

      SHA256

      e7555ca5dc886c59ee3e2542773fbc66a40805ce178bfc775594f052f6422552

      SHA512

      83ebbfb1d6577af2d2a454ed01e6fd58f5a98417b874ae81558cf8c8920a32457df5a9f8b12a9260579d7187c1363b443169a668e670972b838b9c13529ab71b

    • C:\Windows\SysWOW64\Eldlhckj.exe

      Filesize

      314KB

      MD5

      60de038dbe27c81d4d345e241171059a

      SHA1

      5061dd9f07e4d1fab7914a4a2935a7d9297647bc

      SHA256

      e7555ca5dc886c59ee3e2542773fbc66a40805ce178bfc775594f052f6422552

      SHA512

      83ebbfb1d6577af2d2a454ed01e6fd58f5a98417b874ae81558cf8c8920a32457df5a9f8b12a9260579d7187c1363b443169a668e670972b838b9c13529ab71b

    • memory/1040-67-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/1040-64-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/1044-0-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/1044-66-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/1044-1-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/1160-24-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/1160-72-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/2704-68-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/2704-56-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/3136-16-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/3136-73-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/3508-40-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/3508-70-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/3912-71-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/3912-32-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/4896-48-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/4896-69-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/4980-8-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB

    • memory/4980-74-0x0000000000400000-0x0000000000443000-memory.dmp

      Filesize

      268KB