Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
03/11/2023, 15:53
General
-
Target
NEAS.736d6df31b1cfc42580f818558d9cbc0.exe
-
Size
227KB
-
MD5
736d6df31b1cfc42580f818558d9cbc0
-
SHA1
2886bcf715aabb4ec5111e6b55571c400a127fb4
-
SHA256
ef2c970a5722d121a2ab6cab00b8d60d68a5ff8428c6d73a1de5a85fb42bf6b5
-
SHA512
0af9e0d7f14a3a161ce59a8f9db29039ef550de9831f10040f11d4393a417917f08199c90850d8a047c245f4a56ee380f46e40c6b472e92ad69cdd110b48dffa
-
SSDEEP
3072:YsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwRmIBk:ZR5IuMQoseGk7RZBGxAycKpSPX2i
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.736d6df31b1cfc42580f818558d9cbc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.736d6df31b1cfc42580f818558d9cbc0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\browser_broker32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\browser_broker32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\browser_broker32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\NEAS.736d6df31b1cfc42580f818558d9cbc0.exe" && del "C:\Users\Admin\AppData\Local\Temp\NEAS.736d6df31b1cfc42580f818558d9cbc0.exe.config"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\browser_broker32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\browser_broker32.exe arguments1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5695aa8fd538dc7bd76c8f3fc0b60ea54
SHA1201e1e4cbcf76fe205bca0243d43fef4135e0770
SHA25698b73b7bdc9b7d16e9b6537dcd1899599971a4b99e462e4ac1441cf5392aa469
SHA512223f42049bdcd49de102befced7c368d7644e3782529ba4e24a8eeacb49065f63f507b9dcf84587496b167498428ec206134894e86b100eeccaa44ae961fdaaf
-
Filesize
227KB
MD5695aa8fd538dc7bd76c8f3fc0b60ea54
SHA1201e1e4cbcf76fe205bca0243d43fef4135e0770
SHA25698b73b7bdc9b7d16e9b6537dcd1899599971a4b99e462e4ac1441cf5392aa469
SHA512223f42049bdcd49de102befced7c368d7644e3782529ba4e24a8eeacb49065f63f507b9dcf84587496b167498428ec206134894e86b100eeccaa44ae961fdaaf
-
Filesize
227KB
MD5695aa8fd538dc7bd76c8f3fc0b60ea54
SHA1201e1e4cbcf76fe205bca0243d43fef4135e0770
SHA25698b73b7bdc9b7d16e9b6537dcd1899599971a4b99e462e4ac1441cf5392aa469
SHA512223f42049bdcd49de102befced7c368d7644e3782529ba4e24a8eeacb49065f63f507b9dcf84587496b167498428ec206134894e86b100eeccaa44ae961fdaaf
-
Filesize
227KB
MD5695aa8fd538dc7bd76c8f3fc0b60ea54
SHA1201e1e4cbcf76fe205bca0243d43fef4135e0770
SHA25698b73b7bdc9b7d16e9b6537dcd1899599971a4b99e462e4ac1441cf5392aa469
SHA512223f42049bdcd49de102befced7c368d7644e3782529ba4e24a8eeacb49065f63f507b9dcf84587496b167498428ec206134894e86b100eeccaa44ae961fdaaf
-
Filesize
1KB
MD5dd3d04c365984b4ec57a80503f81fddf
SHA1c55fbcb61818e47dac9aae465faff91f0805bd7c
SHA25640a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c
SHA5120dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785
-
Filesize
408KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
664KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB