Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 14:41

General

  • Target

    NEAS.cf9461003d7870f4ac0c1714d104b860.exe

  • Size

    118KB

  • MD5

    cf9461003d7870f4ac0c1714d104b860

  • SHA1

    90549076c16f93390719b9b3489669e5e4261209

  • SHA256

    50911e1a23d33eb4a7bc66387585299339d3971f9933c0aa943c06af6daed9da

  • SHA512

    116b1c79e0cad9c33a146fa4971b4706b7eb57900b2ac93abdecbdb3d322d35a454f20f301b2b4345cb3005db23dacf3ffd4d9445443c665b138ce3a6b38af7a

  • SSDEEP

    3072:vOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:vIs9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.cf9461003d7870f4ac0c1714d104b860.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.cf9461003d7870f4ac0c1714d104b860.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 792
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    7af2c66db12f99ec9edcf2c1ad5ec98d

    SHA1

    fc71bfaf316d940291916e808b0feb981da56941

    SHA256

    dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

    SHA512

    fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    7af2c66db12f99ec9edcf2c1ad5ec98d

    SHA1

    fc71bfaf316d940291916e808b0feb981da56941

    SHA256

    dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

    SHA512

    fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

  • C:\Windows\SysWOW64\grcopy.dll

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    8b7cca691dfdd76a424061a745e5c53b

    SHA1

    6ffbf4f8c12d98e1df02e3a79024e3b0f0681dc1

    SHA256

    59d534fa90205e71e83ab47eb0da13c85b4314f27ef03a1d20a8a0be1402c1c4

    SHA512

    0bfe1e0ca6da1655118a7422d70ff8bf169795a5fac5cb90ddaa0a50b2cf3114ef7538a7e9818b6debea820315fc856ffb9cc38387f6ad8b8aeff083964f4207

  • C:\Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    ebd22461988c870d015150259fbcc4a7

    SHA1

    0587dc7fe709ef8b1b4b1e71c326809416ccd689

    SHA256

    94d9027c3812f657cd60bbb813793be6fcc109a5968d6a280de57d9d4ad1847b

    SHA512

    5ddf528b59c82a4c6906bd42440d9b6c89345df87572a7e043848f73947c562ce1b704fa1824f0ab7bed2e44fbb5b58103249f6165ae8a0a46637c2652181acc

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    7af2c66db12f99ec9edcf2c1ad5ec98d

    SHA1

    fc71bfaf316d940291916e808b0feb981da56941

    SHA256

    dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

    SHA512

    fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    7af2c66db12f99ec9edcf2c1ad5ec98d

    SHA1

    fc71bfaf316d940291916e808b0feb981da56941

    SHA256

    dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

    SHA512

    fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    ebd22461988c870d015150259fbcc4a7

    SHA1

    0587dc7fe709ef8b1b4b1e71c326809416ccd689

    SHA256

    94d9027c3812f657cd60bbb813793be6fcc109a5968d6a280de57d9d4ad1847b

    SHA512

    5ddf528b59c82a4c6906bd42440d9b6c89345df87572a7e043848f73947c562ce1b704fa1824f0ab7bed2e44fbb5b58103249f6165ae8a0a46637c2652181acc

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    ebd22461988c870d015150259fbcc4a7

    SHA1

    0587dc7fe709ef8b1b4b1e71c326809416ccd689

    SHA256

    94d9027c3812f657cd60bbb813793be6fcc109a5968d6a280de57d9d4ad1847b

    SHA512

    5ddf528b59c82a4c6906bd42440d9b6c89345df87572a7e043848f73947c562ce1b704fa1824f0ab7bed2e44fbb5b58103249f6165ae8a0a46637c2652181acc

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    1208e1254b4526f1b5832b5b71b5567c

    SHA1

    e5e05d77332dfd19b06f358ae83a358b12252661

    SHA256

    86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

    SHA512

    6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

  • memory/1948-26-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2816-37-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2816-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2816-43-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2816-44-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3004-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3004-18-0x0000000000420000-0x0000000000429000-memory.dmp

    Filesize

    36KB

  • memory/3004-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3004-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3004-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB