Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 08:38

General

  • Target

    NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe

  • Size

    101KB

  • MD5

    bb5e0b8b3d48cf627fd5a7a479273510

  • SHA1

    348582265cee48ba2fd687689552f743d87a7abd

  • SHA256

    55b178cd4853cc84ffdf427f0c500ec92ae7eacc984e06e34504e5bd0236750d

  • SHA512

    78f8e7cf352bba7370704e5b7062c0a9c489222a064491823c5343445c86694e34149d915eaad5972d4443556038e80314bf6c7c9ad553a9702949195227dfde

  • SSDEEP

    1536:0GYU/W2+HG6lMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7x:0fU/WQ6lMauSuiWNi9CO+WARJrWNZH

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\ProgramData\Update\wuauclt.exe
      "C:\ProgramData\Update\wuauclt.exe" /run
      2⤵
      • Executes dropped EXE
      PID:2220
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe" >> NUL
      2⤵
      • Deletes itself
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Update\wuauclt.exe

    Filesize

    101KB

    MD5

    9b972c0422b35d267b6a8e1162af2465

    SHA1

    fdccca70b72545a896a83e6d9acb0dd19b36208f

    SHA256

    6d51886b0c71521c41d01b1842b520fc426274ccf6f3ad9f90bef70389f69b9f

    SHA512

    cd8f5d7505fd7589de61ded0f90fd2d91f753ed3a20e1b9fac1217d143de2d76ee5406c7f9b504b963f00ab1bccf5bc160804c8ba4218a453b2e1c8eaa2af339

  • \ProgramData\Update\wuauclt.exe

    Filesize

    101KB

    MD5

    9b972c0422b35d267b6a8e1162af2465

    SHA1

    fdccca70b72545a896a83e6d9acb0dd19b36208f

    SHA256

    6d51886b0c71521c41d01b1842b520fc426274ccf6f3ad9f90bef70389f69b9f

    SHA512

    cd8f5d7505fd7589de61ded0f90fd2d91f753ed3a20e1b9fac1217d143de2d76ee5406c7f9b504b963f00ab1bccf5bc160804c8ba4218a453b2e1c8eaa2af339

  • memory/2008-0-0x0000000000FE0000-0x0000000000FFF000-memory.dmp

    Filesize

    124KB

  • memory/2008-4-0x0000000000F90000-0x0000000000FAF000-memory.dmp

    Filesize

    124KB

  • memory/2008-8-0x0000000000FE0000-0x0000000000FFF000-memory.dmp

    Filesize

    124KB

  • memory/2008-9-0x0000000000F90000-0x0000000000FAF000-memory.dmp

    Filesize

    124KB

  • memory/2008-10-0x0000000000FE0000-0x0000000000FFF000-memory.dmp

    Filesize

    124KB

  • memory/2220-7-0x0000000000F90000-0x0000000000FAF000-memory.dmp

    Filesize

    124KB