Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 02:20

General

  • Target

    NEAS.301632a32e63f0053b8be72bbad73220_JC.exe

  • Size

    736KB

  • MD5

    301632a32e63f0053b8be72bbad73220

  • SHA1

    cf3c53b4a8ab4665ae07f938f133f2945074b00c

  • SHA256

    dfdf4d0abe9bd5cfae89bae8b8d54acb8588ff008b77558b73848b6ffd7a727f

  • SHA512

    7057f33c9ade30670fa305a626cd3bb847b1e604a7b07d8ce8a0bb4591f3974efb23c25e91f29adfcffd17ebfc5423f8c15eb71462bd6f4d893bbae4343fa944

  • SSDEEP

    12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdzY3yD25uNlE:P1/aGLDCM4D8ayGMZo8/PY3yDfNlE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.301632a32e63f0053b8be72bbad73220_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.301632a32e63f0053b8be72bbad73220_JC.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\ProgramData\icdfh.exe
      "C:\ProgramData\icdfh.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    736KB

    MD5

    77f2ac7569f58ad1cae7da9c8105a2b5

    SHA1

    68e50a509f49e2652042cc70c7f70ba084bb66b2

    SHA256

    078a5dcd55214356c422639dca2a61f1a5d4ed9255c68302d3ed205229b8a3d1

    SHA512

    e929f96d0a88ef23e1d9469026468af9df5264f530fe65cbc9e11a925e5e9537e788fff7e8d3ab9c32f0e4bd6d3bc49d6ed22879628e0ff3fc773f82b37ad417

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\icdfh.exe

    Filesize

    258KB

    MD5

    fa1859fd8a000a5c87d90bb4c17cb9b4

    SHA1

    b2e1db700e7487a263a437f06a3f39fa49fb3641

    SHA256

    4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

    SHA512

    a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

  • C:\ProgramData\icdfh.exe

    Filesize

    258KB

    MD5

    fa1859fd8a000a5c87d90bb4c17cb9b4

    SHA1

    b2e1db700e7487a263a437f06a3f39fa49fb3641

    SHA256

    4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

    SHA512

    a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

  • C:\ProgramData\icdfh.exe

    Filesize

    258KB

    MD5

    fa1859fd8a000a5c87d90bb4c17cb9b4

    SHA1

    b2e1db700e7487a263a437f06a3f39fa49fb3641

    SHA256

    4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

    SHA512

    a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

  • \ProgramData\icdfh.exe

    Filesize

    258KB

    MD5

    fa1859fd8a000a5c87d90bb4c17cb9b4

    SHA1

    b2e1db700e7487a263a437f06a3f39fa49fb3641

    SHA256

    4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

    SHA512

    a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

  • \ProgramData\icdfh.exe

    Filesize

    258KB

    MD5

    fa1859fd8a000a5c87d90bb4c17cb9b4

    SHA1

    b2e1db700e7487a263a437f06a3f39fa49fb3641

    SHA256

    4e64d159b7429ab3c0ba4592053d0bfdaf56f4ffe6603fc56812ec6f8e24aa9b

    SHA512

    a16c62c30885e8d05eb410ab8e39a10fca9d07acd30bb78b4128dc5ac2ca3638bd84f228a2a090ae12df4b80521ae83d9be6998b86d7d02a93d36ede41ae851f

  • memory/2080-12-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2232-102-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2232-1157-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB