Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe
-
Size
25KB
-
MD5
c2b039a23bb7b1be7d4cf1cf10c38570
-
SHA1
3f57bbf8ab667523e4c60094634d3a8cc195128f
-
SHA256
dfa6122994dfe6baa93997497250533b6dc95a4b73dc2044b7bf8998eaafc2d6
-
SHA512
f83e0a280abe774be47247a82bf809c294873195ed8ff9c796bc58981f7a42aeb75c2716f8928ef8cb8f1e87345d862566f7aaeb600e0e9765319e26a89b9943
-
SSDEEP
192:uvxLS4de1HNAUQcX+l2Hg5cIasUU4L3bba4q4APTK7Yypy0kIBCCvrCrNRiAnJ9J:uvxLSkeJndXQrWjMcYyrvL+P0hYw/nIb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 4816 codecupdater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4816 4384 NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe 88 PID 4384 wrote to memory of 4816 4384 NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe 88 PID 4384 wrote to memory of 4816 4384 NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c2b039a23bb7b1be7d4cf1cf10c38570_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"C:\Users\Admin\AppData\Local\Temp\codecupdater.exe"2⤵
- Executes dropped EXE
PID:4816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5d487cecc1085b4f26c9a005287617ce4
SHA115e290c408163ed60fe8721c371bb076441f8018
SHA256cde475975448932d9bec2bafb6e35c3c4faf553a397260b823742cc7183c4e34
SHA512c1e88ff829accc547dc5f607a1058a5c60b10d88bcca96077beb5c010aca94b4121f25180486706a95c62ac11e3f36a8daa2184e58c99aa586f8a1be344c8a93
-
Filesize
25KB
MD5d487cecc1085b4f26c9a005287617ce4
SHA115e290c408163ed60fe8721c371bb076441f8018
SHA256cde475975448932d9bec2bafb6e35c3c4faf553a397260b823742cc7183c4e34
SHA512c1e88ff829accc547dc5f607a1058a5c60b10d88bcca96077beb5c010aca94b4121f25180486706a95c62ac11e3f36a8daa2184e58c99aa586f8a1be344c8a93
-
Filesize
25KB
MD5d487cecc1085b4f26c9a005287617ce4
SHA115e290c408163ed60fe8721c371bb076441f8018
SHA256cde475975448932d9bec2bafb6e35c3c4faf553a397260b823742cc7183c4e34
SHA512c1e88ff829accc547dc5f607a1058a5c60b10d88bcca96077beb5c010aca94b4121f25180486706a95c62ac11e3f36a8daa2184e58c99aa586f8a1be344c8a93