Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 09:29

General

  • Target

    NEAS.0c898540cdb9004d112eabcdefbec5b0.exe

  • Size

    100KB

  • MD5

    0c898540cdb9004d112eabcdefbec5b0

  • SHA1

    e27a91efd33ba2de5c6fdef41128e3609d150646

  • SHA256

    c078f1b6d75f7997b67ed763942cca52e82ad5fbe423f961b3f9045a2298c2ce

  • SHA512

    96ff42da7da66698cc46bb4f724b715b985531e80de7839e2392141b71e9a4fc56112c8121e420006e6ee3f9bdde1dd1f11cfc099b0bc511bd24d6fdd695fb68

  • SSDEEP

    1536:UumICujqx2/gc8LeSGHRuQzljOnSk0ddix8mSB4k/U3MCa7gvc+tmccWwL:UutjqxaeLUljOwd8x8Nqp3MCaoVk

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.0c898540cdb9004d112eabcdefbec5b0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.0c898540cdb9004d112eabcdefbec5b0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\51181e81.exe
      C:\51181e81.exe
      2⤵
      • Sets DLL path for service in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2996
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\51181e81.exe

    Filesize

    87KB

    MD5

    7d963b95ec32242244d9f6bf304551f1

    SHA1

    d4601268a131bff5a95382802221e79d16056d58

    SHA256

    52236c37dbf9327502317e19bf178b4800a71e624e74ea90e76e819884601f32

    SHA512

    fda7d0d2426f5a27b7d5c4bfa22d8f9c8dfdc491fe8e56569166adb721b95919c85094dd0b510dbb79091645739282f8967f872dab5eb19aec122473b0209f48

  • C:\51181e81.exe

    Filesize

    87KB

    MD5

    7d963b95ec32242244d9f6bf304551f1

    SHA1

    d4601268a131bff5a95382802221e79d16056d58

    SHA256

    52236c37dbf9327502317e19bf178b4800a71e624e74ea90e76e819884601f32

    SHA512

    fda7d0d2426f5a27b7d5c4bfa22d8f9c8dfdc491fe8e56569166adb721b95919c85094dd0b510dbb79091645739282f8967f872dab5eb19aec122473b0209f48

  • C:\51181e81.exe

    Filesize

    87KB

    MD5

    7d963b95ec32242244d9f6bf304551f1

    SHA1

    d4601268a131bff5a95382802221e79d16056d58

    SHA256

    52236c37dbf9327502317e19bf178b4800a71e624e74ea90e76e819884601f32

    SHA512

    fda7d0d2426f5a27b7d5c4bfa22d8f9c8dfdc491fe8e56569166adb721b95919c85094dd0b510dbb79091645739282f8967f872dab5eb19aec122473b0209f48

  • C:\Users\Infotmp.txt

    Filesize

    460B

    MD5

    ff3bd254698f9f8ccbccce9592ffcd06

    SHA1

    b3b76b94f823eb9fff8910d352f3afce2cfd4f80

    SHA256

    a19fe757f0250d74ca8a3629c31379fb87a8a6aafee113ba267db086b8887a18

    SHA512

    589d979079e7b0b26d82907991b7191b20319a5273eac3b7c3c20ef46c2251d4c87f0ac1a6a8a9734d5095d8f1fbb3aa5c0c139b41479634c4bb5fccad63b00e

  • \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll

    Filesize

    87KB

    MD5

    15c820896d84d672def8dbdfc9185511

    SHA1

    c765bbca73cf6da1665b6779e2572759d5c188f6

    SHA256

    cef5c69b54651dd8bdc2525a77cf47f9f90d02bed5b20d349b730ecc6022ce3e

    SHA512

    a1daddfd7978e83c35b6d5c1f95b069aa5baf9f455f24a4460b2bae1fde8038d8fbf7746dfac77e1e49f9955000027494e51c4112ac723fbe8deaad2b8181c9f

  • \Windows\SysWOW64\000004B4.tmp

    Filesize

    87KB

    MD5

    15c820896d84d672def8dbdfc9185511

    SHA1

    c765bbca73cf6da1665b6779e2572759d5c188f6

    SHA256

    cef5c69b54651dd8bdc2525a77cf47f9f90d02bed5b20d349b730ecc6022ce3e

    SHA512

    a1daddfd7978e83c35b6d5c1f95b069aa5baf9f455f24a4460b2bae1fde8038d8fbf7746dfac77e1e49f9955000027494e51c4112ac723fbe8deaad2b8181c9f

  • \Windows\SysWOW64\FastUserSwitchingCompatibility.dll

    Filesize

    87KB

    MD5

    15c820896d84d672def8dbdfc9185511

    SHA1

    c765bbca73cf6da1665b6779e2572759d5c188f6

    SHA256

    cef5c69b54651dd8bdc2525a77cf47f9f90d02bed5b20d349b730ecc6022ce3e

    SHA512

    a1daddfd7978e83c35b6d5c1f95b069aa5baf9f455f24a4460b2bae1fde8038d8fbf7746dfac77e1e49f9955000027494e51c4112ac723fbe8deaad2b8181c9f

  • memory/2724-30-0x00000000742E0000-0x0000000074304000-memory.dmp

    Filesize

    144KB

  • memory/2724-35-0x00000000742E0000-0x0000000074304000-memory.dmp

    Filesize

    144KB

  • memory/2724-31-0x00000000742E0000-0x0000000074304000-memory.dmp

    Filesize

    144KB

  • memory/2724-29-0x00000000742E0000-0x0000000074304000-memory.dmp

    Filesize

    144KB

  • memory/2908-1-0x0000000000020000-0x000000000003B000-memory.dmp

    Filesize

    108KB

  • memory/2908-0-0x0000000001000000-0x000000000101B000-memory.dmp

    Filesize

    108KB

  • memory/2908-5-0x0000000000AA0000-0x0000000000AC4000-memory.dmp

    Filesize

    144KB

  • memory/2908-23-0x0000000001000000-0x000000000101B000-memory.dmp

    Filesize

    108KB

  • memory/2908-24-0x0000000000020000-0x000000000003B000-memory.dmp

    Filesize

    108KB

  • memory/2908-25-0x0000000000020000-0x000000000003B000-memory.dmp

    Filesize

    108KB

  • memory/2908-2-0x0000000000020000-0x000000000003B000-memory.dmp

    Filesize

    108KB

  • memory/2908-34-0x0000000001000000-0x000000000101B000-memory.dmp

    Filesize

    108KB

  • memory/2908-10-0x0000000000AA0000-0x0000000000AC4000-memory.dmp

    Filesize

    144KB

  • memory/2996-18-0x000000007701F000-0x0000000077020000-memory.dmp

    Filesize

    4KB

  • memory/2996-15-0x0000000000AA0000-0x0000000000AC4000-memory.dmp

    Filesize

    144KB

  • memory/2996-19-0x00000000752A0000-0x0000000075300000-memory.dmp

    Filesize

    384KB

  • memory/2996-22-0x00000000742E0000-0x0000000074304000-memory.dmp

    Filesize

    144KB

  • memory/2996-33-0x0000000000AA0000-0x0000000000AC4000-memory.dmp

    Filesize

    144KB

  • memory/2996-13-0x0000000000AA0000-0x0000000000AC4000-memory.dmp

    Filesize

    144KB

  • memory/2996-36-0x00000000752A0000-0x0000000075300000-memory.dmp

    Filesize

    384KB