Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.42143903d0dd05e55086b7d891da6df0.exe
Resource
win7-20231023-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.42143903d0dd05e55086b7d891da6df0.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
NEAS.42143903d0dd05e55086b7d891da6df0.exe
-
Size
204KB
-
MD5
42143903d0dd05e55086b7d891da6df0
-
SHA1
35ed3a3d5a349d2f4f8a177df9be6069c373d436
-
SHA256
c18a9a7e3258c2a6633943debc129a4aa997fefcc1bdf85d25dd2dfdb5c87a9e
-
SHA512
1ad520741ab531d29fe191bbca25af9a6db4d80c1c92f056b66aca6972178febff53aa04b286ca7773fba9db899f98686b52fa6d8ddd49d8f877a8339cb681bf
-
SSDEEP
3072:QmyW8S0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWij:rn54QxL7B9W0c1RCzR/fSmlX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" NEAS.42143903d0dd05e55086b7d891da6df0.exe Set value (int) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duaara.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.42143903d0dd05e55086b7d891da6df0.exe -
Executes dropped EXE 1 IoCs
pid Process 4296 duaara.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /x" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /h" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /z" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /f" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /u" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /j" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /d" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /e" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /n" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /k" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /b" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /q" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /p" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /i" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /l" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /c" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /g" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /w" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /v" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /r" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /y" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /s" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /a" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /m" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /i" NEAS.42143903d0dd05e55086b7d891da6df0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /o" duaara.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\duaara = "C:\\Users\\Admin\\duaara.exe /t" duaara.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 NEAS.42143903d0dd05e55086b7d891da6df0.exe 2360 NEAS.42143903d0dd05e55086b7d891da6df0.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe 4296 duaara.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 NEAS.42143903d0dd05e55086b7d891da6df0.exe 4296 duaara.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2360 wrote to memory of 4296 2360 NEAS.42143903d0dd05e55086b7d891da6df0.exe 95 PID 2360 wrote to memory of 4296 2360 NEAS.42143903d0dd05e55086b7d891da6df0.exe 95 PID 2360 wrote to memory of 4296 2360 NEAS.42143903d0dd05e55086b7d891da6df0.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.42143903d0dd05e55086b7d891da6df0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.42143903d0dd05e55086b7d891da6df0.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\duaara.exe"C:\Users\Admin\duaara.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5ece093dbe346e2136078e4c6316847d3
SHA188f9b3b72d433f24b1192229c454cb8285be079d
SHA256eb94827978372c6f20e645baeee3296086482a859a1ad03a7fcfb8d29f5dacf1
SHA512f226661b285b6c7e775eda2d04763a7d0b83a92fb5b1c7450629df36b38e90e0300c4feae2c7c097daf9bab36a1aae89eb1bbe21fd9e262a6aa843025e799526
-
Filesize
204KB
MD5ece093dbe346e2136078e4c6316847d3
SHA188f9b3b72d433f24b1192229c454cb8285be079d
SHA256eb94827978372c6f20e645baeee3296086482a859a1ad03a7fcfb8d29f5dacf1
SHA512f226661b285b6c7e775eda2d04763a7d0b83a92fb5b1c7450629df36b38e90e0300c4feae2c7c097daf9bab36a1aae89eb1bbe21fd9e262a6aa843025e799526
-
Filesize
204KB
MD5ece093dbe346e2136078e4c6316847d3
SHA188f9b3b72d433f24b1192229c454cb8285be079d
SHA256eb94827978372c6f20e645baeee3296086482a859a1ad03a7fcfb8d29f5dacf1
SHA512f226661b285b6c7e775eda2d04763a7d0b83a92fb5b1c7450629df36b38e90e0300c4feae2c7c097daf9bab36a1aae89eb1bbe21fd9e262a6aa843025e799526