Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
03/11/2023, 09:29
General
-
Target
NEAS.0c898540cdb9004d112eabcdefbec5b0.exe
-
Size
100KB
-
MD5
0c898540cdb9004d112eabcdefbec5b0
-
SHA1
e27a91efd33ba2de5c6fdef41128e3609d150646
-
SHA256
c078f1b6d75f7997b67ed763942cca52e82ad5fbe423f961b3f9045a2298c2ce
-
SHA512
96ff42da7da66698cc46bb4f724b715b985531e80de7839e2392141b71e9a4fc56112c8121e420006e6ee3f9bdde1dd1f11cfc099b0bc511bd24d6fdd695fb68
-
SSDEEP
1536:UumICujqx2/gc8LeSGHRuQzljOnSk0ddix8mSB4k/U3MCa7gvc+tmccWwL:UutjqxaeLUljOwd8x8Nqp3MCaoVk
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0c898540cdb9004d112eabcdefbec5b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0c898540cdb9004d112eabcdefbec5b0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\51181e81.exeC:\51181e81.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD57d963b95ec32242244d9f6bf304551f1
SHA1d4601268a131bff5a95382802221e79d16056d58
SHA25652236c37dbf9327502317e19bf178b4800a71e624e74ea90e76e819884601f32
SHA512fda7d0d2426f5a27b7d5c4bfa22d8f9c8dfdc491fe8e56569166adb721b95919c85094dd0b510dbb79091645739282f8967f872dab5eb19aec122473b0209f48
-
Filesize
87KB
MD57d963b95ec32242244d9f6bf304551f1
SHA1d4601268a131bff5a95382802221e79d16056d58
SHA25652236c37dbf9327502317e19bf178b4800a71e624e74ea90e76e819884601f32
SHA512fda7d0d2426f5a27b7d5c4bfa22d8f9c8dfdc491fe8e56569166adb721b95919c85094dd0b510dbb79091645739282f8967f872dab5eb19aec122473b0209f48
-
Filesize
460B
MD5bf7eaf4fea30a731be51bfce4c1d1cfb
SHA165ad7a8c98d8c04c574a2f3a14dced50fb23c52f
SHA2562003195af4c6372966c668a0c874a50870d60104dd066df9e990a735bf03c6df
SHA512e06b84e0ef20094e9e0d3738aa8aa492188eb4de9faf2af3f5b45823496a5a37ece423ac8625020539ed10961139bf3eb043762a6c0aee01c744d5bea9659d2e
-
Filesize
87KB
MD515c820896d84d672def8dbdfc9185511
SHA1c765bbca73cf6da1665b6779e2572759d5c188f6
SHA256cef5c69b54651dd8bdc2525a77cf47f9f90d02bed5b20d349b730ecc6022ce3e
SHA512a1daddfd7978e83c35b6d5c1f95b069aa5baf9f455f24a4460b2bae1fde8038d8fbf7746dfac77e1e49f9955000027494e51c4112ac723fbe8deaad2b8181c9f
-
Filesize
87KB
MD515c820896d84d672def8dbdfc9185511
SHA1c765bbca73cf6da1665b6779e2572759d5c188f6
SHA256cef5c69b54651dd8bdc2525a77cf47f9f90d02bed5b20d349b730ecc6022ce3e
SHA512a1daddfd7978e83c35b6d5c1f95b069aa5baf9f455f24a4460b2bae1fde8038d8fbf7746dfac77e1e49f9955000027494e51c4112ac723fbe8deaad2b8181c9f
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
144KB
-
Filesize
148KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
148KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB