Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    163s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2023, 16:29

General

  • Target

    NEAS.72ae10e4d1fdcd97bf06426615245280.exe

  • Size

    39KB

  • MD5

    72ae10e4d1fdcd97bf06426615245280

  • SHA1

    6bbbf01047694d2005704a693136c545ace89d4f

  • SHA256

    6ed6be268f6d99bb99df31b513fa0e559247c3a46331662bcab1a00540fe9871

  • SHA512

    33741c38aa3c7c3f59796363a259dc03548f90b16f6a021e58bc770bff6b6d2ff58c51a68cedb9eac4253383a8650283ab9b0ce776ce95424e50f91bc92f3d53

  • SSDEEP

    768:CybDkdsqw8guzZFcWiVEaNMDcoWiVE6tu1MJXOs26nGMhKCzed:CGMG8tz3cFE4oFE6DzBKD

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.72ae10e4d1fdcd97bf06426615245280.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.72ae10e4d1fdcd97bf06426615245280.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Users\Admin\AppData\Local\Temp\ykqie.exe
      "C:\Users\Admin\AppData\Local\Temp\ykqie.exe"
      2⤵
      • Executes dropped EXE
      PID:1788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ykqie.exe

    Filesize

    39KB

    MD5

    3bdef1713a873d8d8cb431fc5dce2a5b

    SHA1

    325493fef79c3ad954bc5827ecb96a447e97b79e

    SHA256

    78041dd20670aa60fef253df52e75cb4aa4356f14ce51f34aa19fde02111de9c

    SHA512

    7ab93ed600faec454faa074390234fdd8006c996be7fdbcfca99f77593629df333dc3e729299d3e67981191ab8a76aa9828dacc56c89d6a235752f59319080b0

  • C:\Users\Admin\AppData\Local\Temp\ykqie.exe

    Filesize

    39KB

    MD5

    3bdef1713a873d8d8cb431fc5dce2a5b

    SHA1

    325493fef79c3ad954bc5827ecb96a447e97b79e

    SHA256

    78041dd20670aa60fef253df52e75cb4aa4356f14ce51f34aa19fde02111de9c

    SHA512

    7ab93ed600faec454faa074390234fdd8006c996be7fdbcfca99f77593629df333dc3e729299d3e67981191ab8a76aa9828dacc56c89d6a235752f59319080b0

  • C:\Users\Admin\AppData\Local\Temp\ykqie.exe

    Filesize

    39KB

    MD5

    3bdef1713a873d8d8cb431fc5dce2a5b

    SHA1

    325493fef79c3ad954bc5827ecb96a447e97b79e

    SHA256

    78041dd20670aa60fef253df52e75cb4aa4356f14ce51f34aa19fde02111de9c

    SHA512

    7ab93ed600faec454faa074390234fdd8006c996be7fdbcfca99f77593629df333dc3e729299d3e67981191ab8a76aa9828dacc56c89d6a235752f59319080b0

  • memory/1788-11-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1952-0-0x00000000009B0000-0x00000000009B1000-memory.dmp

    Filesize

    4KB

  • memory/1952-2-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB