Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
03/11/2023, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe
-
Size
101KB
-
MD5
bb5e0b8b3d48cf627fd5a7a479273510
-
SHA1
348582265cee48ba2fd687689552f743d87a7abd
-
SHA256
55b178cd4853cc84ffdf427f0c500ec92ae7eacc984e06e34504e5bd0236750d
-
SHA512
78f8e7cf352bba7370704e5b7062c0a9c489222a064491823c5343445c86694e34149d915eaad5972d4443556038e80314bf6c7c9ad553a9702949195227dfde
-
SSDEEP
1536:0GYU/W2+HG6lMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7x:0fU/WQ6lMauSuiWNi9CO+WARJrWNZH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2732 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2220 wuauclt.exe -
Loads dropped DLL 1 IoCs
pid Process 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run" NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2220 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 28 PID 2008 wrote to memory of 2220 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 28 PID 2008 wrote to memory of 2220 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 28 PID 2008 wrote to memory of 2220 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 28 PID 2008 wrote to memory of 2732 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 31 PID 2008 wrote to memory of 2732 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 31 PID 2008 wrote to memory of 2732 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 31 PID 2008 wrote to memory of 2732 2008 NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\ProgramData\Update\wuauclt.exe"C:\ProgramData\Update\wuauclt.exe" /run2⤵
- Executes dropped EXE
PID:2220
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.bb5e0b8b3d48cf627fd5a7a479273510.exe" >> NUL2⤵
- Deletes itself
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD59b972c0422b35d267b6a8e1162af2465
SHA1fdccca70b72545a896a83e6d9acb0dd19b36208f
SHA2566d51886b0c71521c41d01b1842b520fc426274ccf6f3ad9f90bef70389f69b9f
SHA512cd8f5d7505fd7589de61ded0f90fd2d91f753ed3a20e1b9fac1217d143de2d76ee5406c7f9b504b963f00ab1bccf5bc160804c8ba4218a453b2e1c8eaa2af339
-
Filesize
101KB
MD59b972c0422b35d267b6a8e1162af2465
SHA1fdccca70b72545a896a83e6d9acb0dd19b36208f
SHA2566d51886b0c71521c41d01b1842b520fc426274ccf6f3ad9f90bef70389f69b9f
SHA512cd8f5d7505fd7589de61ded0f90fd2d91f753ed3a20e1b9fac1217d143de2d76ee5406c7f9b504b963f00ab1bccf5bc160804c8ba4218a453b2e1c8eaa2af339