Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    8s
  • max time network
    38s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 15:44

General

  • Target

    NEAS.a5d40872d05137e574dacef2149acf40.exe

  • Size

    132KB

  • MD5

    a5d40872d05137e574dacef2149acf40

  • SHA1

    76eabeae178e0d2f3ca1429b2e9282627e7a4695

  • SHA256

    bd95e31e7180c1929a8d0d6afb8a738aaba94cfd50a50b22e25ac94eb4854eff

  • SHA512

    3001e1f7a5f2840469c43e3706e901ab566360fc4f47d541150bc5f965d776379c97cf5d0cde1686b532aea7d3d20aafc81f23bee2c6f1bd83d8cf431b280629

  • SSDEEP

    3072:J3UG0Trhel16r6cLlFSEDfO/rdVb2C/tld2w056Ap8wtJ+8:J3ZCYmGMNfzYHd2fplT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.a5d40872d05137e574dacef2149acf40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a5d40872d05137e574dacef2149acf40.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\NEAS.a5d40872d05137e574dacef2149acf40.exe.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a5d40872d05137e574dacef2149acf40.exe.exe"
      2⤵
      • Executes dropped EXE
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.buf

    Filesize

    1.7MB

    MD5

    b6124df806d5419e5dd276b30134c5c6

    SHA1

    33e1c6fb510af50b69fb4ac4d50cd5989560e324

    SHA256

    908b3bd8a47ee88d9853b2bd342fbd291ba2737151577c1a5d7195cccf13587b

    SHA512

    31425db7c698dc50d715b9020cc4369e608a199aae089790408da691e5e0cb5ed5f1a81e331edcb8bc17e7143905ada8ea887d73528eb0a558efeacc923b732a

  • C:\Users\Admin\AppData\Local\Temp\NEAS.a5d40872d05137e574dacef2149acf40.exe.exe

    Filesize

    16KB

    MD5

    36c766f80da94fe10fb6ebed2ac404b8

    SHA1

    a07443ccbcb6af10d312072aeb8d1bfe74bb5efb

    SHA256

    1bf5da4244994df5aad4b0c9a3f184f8462c4deb95525e93c2e616eecabfd419

    SHA512

    e39fcf32d62c686c8d801b1dd388e9c007f8056e8e850b04ede8e6b1ae8ec30c159b1e6db1f63a59c99904a8b10da09c2f22eb327b84f5177b71eb280af1fe06

  • \Users\Admin\AppData\Local\Temp\NEAS.a5d40872d05137e574dacef2149acf40.exe.exe

    Filesize

    16KB

    MD5

    36c766f80da94fe10fb6ebed2ac404b8

    SHA1

    a07443ccbcb6af10d312072aeb8d1bfe74bb5efb

    SHA256

    1bf5da4244994df5aad4b0c9a3f184f8462c4deb95525e93c2e616eecabfd419

    SHA512

    e39fcf32d62c686c8d801b1dd388e9c007f8056e8e850b04ede8e6b1ae8ec30c159b1e6db1f63a59c99904a8b10da09c2f22eb327b84f5177b71eb280af1fe06

  • memory/2152-113-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB