Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2023, 03:01

General

  • Target

    NEAS.f4f35b3cb49f183434836f1afd5bbb60_JC.exe

  • Size

    359KB

  • MD5

    f4f35b3cb49f183434836f1afd5bbb60

  • SHA1

    c4956a2a71d58ef7b1468971ed9b10adabbca544

  • SHA256

    44020586bfffd552c1fc8d9b56e89fc7889bd88015b0376c79982d967ea526c9

  • SHA512

    f1ecf14a3d39302f1bf01689d1e818ca9d326a6e09be132ce64c2848a136b3a1d4e07698c70f3695ecabc107a1fa2976b43b800a9c67d192988ef3a7645ff7aa

  • SSDEEP

    3072:faeniBZ414sfEAH0kQI8Va3CkfUVuyelbvP5lkzmQ1o0Otw44KmfpKivFM6WpqXJ:fae8GyGfHprba4Yb31/doG

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs
  • Executes dropped EXE 7 IoCs
  • Drops file in System32 directory 21 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.f4f35b3cb49f183434836f1afd5bbb60_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f4f35b3cb49f183434836f1afd5bbb60_JC.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Windows\SysWOW64\Cegdnopg.exe
      C:\Windows\system32\Cegdnopg.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\SysWOW64\Danecp32.exe
        C:\Windows\system32\Danecp32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Windows\SysWOW64\Dhhnpjmh.exe
          C:\Windows\system32\Dhhnpjmh.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Windows\SysWOW64\Delnin32.exe
            C:\Windows\system32\Delnin32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1320
            • C:\Windows\SysWOW64\Dfpgffpm.exe
              C:\Windows\system32\Dfpgffpm.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1284
              • C:\Windows\SysWOW64\Dhocqigp.exe
                C:\Windows\system32\Dhocqigp.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4388
                • C:\Windows\SysWOW64\Dmllipeg.exe
                  C:\Windows\system32\Dmllipeg.exe
                  8⤵
                  • Executes dropped EXE
                  PID:2948
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 228
                    9⤵
                    • Program crash
                    PID:3016
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2948 -ip 2948
    1⤵
      PID:3476

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Cegdnopg.exe

      Filesize

      359KB

      MD5

      51def4267038e1ddbe4d2809a2b30a3a

      SHA1

      886c5cee801e606738e0a951c2f545c5ec1f9d7c

      SHA256

      710aaa7916f181f5320287391ca1e19abce3339435278ad7ee14def0e9448899

      SHA512

      b7a217605d4bf7d87fee4828fc5673ff69d6b39657cf57fd4a5c6e86dfbd18ca79ccf4b8fc247027d9c60cc9a246f82234865500f7665863335846ed57f9a90a

    • C:\Windows\SysWOW64\Cegdnopg.exe

      Filesize

      359KB

      MD5

      51def4267038e1ddbe4d2809a2b30a3a

      SHA1

      886c5cee801e606738e0a951c2f545c5ec1f9d7c

      SHA256

      710aaa7916f181f5320287391ca1e19abce3339435278ad7ee14def0e9448899

      SHA512

      b7a217605d4bf7d87fee4828fc5673ff69d6b39657cf57fd4a5c6e86dfbd18ca79ccf4b8fc247027d9c60cc9a246f82234865500f7665863335846ed57f9a90a

    • C:\Windows\SysWOW64\Danecp32.exe

      Filesize

      359KB

      MD5

      c0f7b5654e970fc49f93544e2f7e95d9

      SHA1

      87c78b9530365429aca4d421e6c7a2b224fddc65

      SHA256

      55b7031c5bdacd7b35e9bf68fdfed2d1be10a7b81148bebf880ee22398af7a63

      SHA512

      8f3591eb41beb8d2d1210103f48c1679489962a718818f24632ea54776dc2ad5ee5bf64c77115a58c4e178e677d19ad29e712a525afc850c478dc5882e9fcdd5

    • C:\Windows\SysWOW64\Danecp32.exe

      Filesize

      359KB

      MD5

      c0f7b5654e970fc49f93544e2f7e95d9

      SHA1

      87c78b9530365429aca4d421e6c7a2b224fddc65

      SHA256

      55b7031c5bdacd7b35e9bf68fdfed2d1be10a7b81148bebf880ee22398af7a63

      SHA512

      8f3591eb41beb8d2d1210103f48c1679489962a718818f24632ea54776dc2ad5ee5bf64c77115a58c4e178e677d19ad29e712a525afc850c478dc5882e9fcdd5

    • C:\Windows\SysWOW64\Delnin32.exe

      Filesize

      359KB

      MD5

      240a2a611b08e6f641900202c67a1dad

      SHA1

      b4cf612b5eb4ca232b3a10f8dc5ff5aee11c11ff

      SHA256

      fff4e6379a4ee5910ad2f9b40035114b59185ee2ed196ad8145e72447f464dab

      SHA512

      c4afecd3584bbd8e0832a7f4c789908901dda101d0eedba28b0205d09b81bc1e0c4aca51c3406e4cab0007474d34f86fbf42203f9522cd3fded5979d2e84b167

    • C:\Windows\SysWOW64\Delnin32.exe

      Filesize

      359KB

      MD5

      3df176d127be1b455db1dabbdf67f799

      SHA1

      8d0de13c7c261ada93cb5449c23137586ee5c912

      SHA256

      4b52b3e66a4f39104f3ac0aeec7d242bd0029cbe085bafd16e3e94e4ee390bcd

      SHA512

      e5cf99a6527f2c46f47980256cfef96c453b38439d958dd82f8ee84228972965dd715459f36a604539f1d0478391b9d29489cad0a307b15b690fb70730a7911a

    • C:\Windows\SysWOW64\Delnin32.exe

      Filesize

      359KB

      MD5

      3df176d127be1b455db1dabbdf67f799

      SHA1

      8d0de13c7c261ada93cb5449c23137586ee5c912

      SHA256

      4b52b3e66a4f39104f3ac0aeec7d242bd0029cbe085bafd16e3e94e4ee390bcd

      SHA512

      e5cf99a6527f2c46f47980256cfef96c453b38439d958dd82f8ee84228972965dd715459f36a604539f1d0478391b9d29489cad0a307b15b690fb70730a7911a

    • C:\Windows\SysWOW64\Dfpgffpm.exe

      Filesize

      359KB

      MD5

      43d932216b02ddfc984a1fc1215692f8

      SHA1

      af583a60799fc271cccc80b02cfd18af8bc43a52

      SHA256

      91701f16d5078ff49e00a128af413b1b75ad774f5b66df9c1a7dddd407b8814b

      SHA512

      860fe078016bae1ee4faf1627e93ddbee232fe5daf3e50b63aea793aaf63c9e8753b005ab437bc4347c0335bc041321df52a73a0d3cf7e43713ffac3c10122c5

    • C:\Windows\SysWOW64\Dfpgffpm.exe

      Filesize

      359KB

      MD5

      43d932216b02ddfc984a1fc1215692f8

      SHA1

      af583a60799fc271cccc80b02cfd18af8bc43a52

      SHA256

      91701f16d5078ff49e00a128af413b1b75ad774f5b66df9c1a7dddd407b8814b

      SHA512

      860fe078016bae1ee4faf1627e93ddbee232fe5daf3e50b63aea793aaf63c9e8753b005ab437bc4347c0335bc041321df52a73a0d3cf7e43713ffac3c10122c5

    • C:\Windows\SysWOW64\Dhhnpjmh.exe

      Filesize

      359KB

      MD5

      240a2a611b08e6f641900202c67a1dad

      SHA1

      b4cf612b5eb4ca232b3a10f8dc5ff5aee11c11ff

      SHA256

      fff4e6379a4ee5910ad2f9b40035114b59185ee2ed196ad8145e72447f464dab

      SHA512

      c4afecd3584bbd8e0832a7f4c789908901dda101d0eedba28b0205d09b81bc1e0c4aca51c3406e4cab0007474d34f86fbf42203f9522cd3fded5979d2e84b167

    • C:\Windows\SysWOW64\Dhhnpjmh.exe

      Filesize

      359KB

      MD5

      240a2a611b08e6f641900202c67a1dad

      SHA1

      b4cf612b5eb4ca232b3a10f8dc5ff5aee11c11ff

      SHA256

      fff4e6379a4ee5910ad2f9b40035114b59185ee2ed196ad8145e72447f464dab

      SHA512

      c4afecd3584bbd8e0832a7f4c789908901dda101d0eedba28b0205d09b81bc1e0c4aca51c3406e4cab0007474d34f86fbf42203f9522cd3fded5979d2e84b167

    • C:\Windows\SysWOW64\Dhocqigp.exe

      Filesize

      359KB

      MD5

      d81b6c294b8e84a70ccfcd17d6acef49

      SHA1

      7d54b9305733001adb047c39a10a6a5c44eda988

      SHA256

      68563832bfb38d7615fc94d24fb757aaeec71f64dd6af3e041adbee18a95875a

      SHA512

      c0728d0dc9ed64ae50449c21bd6ee80bf33315b21bbf1b52ea5e0698f078be7f4eeaac88b61cf99357d63d9d53906b64075bcae62ad1d102046425a90dc942e8

    • C:\Windows\SysWOW64\Dhocqigp.exe

      Filesize

      359KB

      MD5

      d81b6c294b8e84a70ccfcd17d6acef49

      SHA1

      7d54b9305733001adb047c39a10a6a5c44eda988

      SHA256

      68563832bfb38d7615fc94d24fb757aaeec71f64dd6af3e041adbee18a95875a

      SHA512

      c0728d0dc9ed64ae50449c21bd6ee80bf33315b21bbf1b52ea5e0698f078be7f4eeaac88b61cf99357d63d9d53906b64075bcae62ad1d102046425a90dc942e8

    • C:\Windows\SysWOW64\Dmllipeg.exe

      Filesize

      359KB

      MD5

      e7f350b70af16da4888f8134447a3a49

      SHA1

      d35f299312c73b9a7bb80480b6da8078e0db720e

      SHA256

      ea45633b3f3424032a7d93742246a7e1ba00f97138c0f26cf2cab701fb2c969d

      SHA512

      fb53757a243f9bb44a3a7943658d71785cb4a0c03e7342f3e0967a06399c60b86619f1a35335c959042a29c520b8b287d22018b0264ebb91927c653de76b7e2c

    • C:\Windows\SysWOW64\Dmllipeg.exe

      Filesize

      359KB

      MD5

      e7f350b70af16da4888f8134447a3a49

      SHA1

      d35f299312c73b9a7bb80480b6da8078e0db720e

      SHA256

      ea45633b3f3424032a7d93742246a7e1ba00f97138c0f26cf2cab701fb2c969d

      SHA512

      fb53757a243f9bb44a3a7943658d71785cb4a0c03e7342f3e0967a06399c60b86619f1a35335c959042a29c520b8b287d22018b0264ebb91927c653de76b7e2c

    • memory/536-64-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/536-8-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/800-65-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/800-1-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/800-0-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1284-40-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1284-60-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1320-32-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1320-61-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2948-56-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2948-58-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4084-62-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4084-24-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4128-63-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4128-17-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4388-49-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4388-59-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB