Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe
-
Size
474KB
-
MD5
f28d04b2c360090d14406da06e074dd0
-
SHA1
a25bb3ef66901953a74158c92db8222a8f207480
-
SHA256
429ae58fec755e4c91b8888e08d74401786d8869a89899e5d2ba0a542eceb709
-
SHA512
3c5b69ec08a4c2af7ab872a7fe00a2041dd57175ebbf84909921e7ff8afac78a93f51e412cf204753674df34b1f7c565a282c0e9d778684e45214e018c0417fb
-
SSDEEP
6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKEl6:nRDc3yWDNU+YUznzNjElWaT07NQt6
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\users\admin\appdata\local\temp\neas.f28d04b2c360090d14406da06e074dd0_jc.exe = "c:\\users\\admin\\appdata\\local\\temp\\neas.f28d04b2c360090d14406da06e074dd0_jc.exe:*:Enabled:SMPN" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msrpc = "c:\\windows\\msrpc.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Key created \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wdfmgr\ImagePath = "c:\\windows\\wdfmgr.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\wdfmgr = "c:\\windows\\wdfmgr.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsassv = "c:\\windows\\lsassv.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\i: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\x: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\w: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\u: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\r: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\h: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\y: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\v: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\s: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\q: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\p: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\k: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\j: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\z: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\o: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\n: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\m: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\l: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\g: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened (read-only) \??\e: NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\regedit.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created \??\c:\windows\lsassv.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File created \??\c:\windows\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\AdobeLoader.scr NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File created \??\c:\windows\wdfmgr.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened for modification \??\c:\windows\mui\rctfd.sys NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened for modification \??\c:\windows\wdfmgr.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened for modification \??\c:\windows\msrpc.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened for modification \??\c:\windows\calc.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File created \??\c:\windows\regedit2.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened for modification \??\c:\windows\lsassv.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File created \??\c:\windows\msrpc.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File created \??\c:\windows\calc.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File opened for modification \??\c:\windows\regedit2.exe NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe File created \??\c:\windows\Start Menu\Programs\Startup\AdobeLoader.scr NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\ThisEXE = "c:\\users\\admin\\appdata\\local\\temp\\neas.f28d04b2c360090d14406da06e074dd0_jc.exe" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\VerProg = "157" NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f28d04b2c360090d14406da06e074dd0_JC.exe"1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2848
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
474KB
MD5dd61a79e208a288ac7d2bbeb95238c2d
SHA13b91f9597155ddeeb474e4dc6dad030cd41da33d
SHA256c2372d6d402234adad0503302a6a29cb25c1fc75344bbe56d23763562e2e9091
SHA5128e01b410d10fd4920829947c55acf2cd1e378d9e893580508c7462d1e9cf0fdd65b47bd8ec9e7903bfd433c164ae6234e19ae17e2d8f62428804e9f26580d818