Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
03/11/2023, 20:00
General
-
Target
NEAS.4a23f7c70d80bd12a07c463783b72120_JC.exe
-
Size
135KB
-
MD5
4a23f7c70d80bd12a07c463783b72120
-
SHA1
116821b3147601c7605218a02e920e07238d199e
-
SHA256
b3de53d4867b951188d42690f40c29709d295e471314920955e9fd7bdc179b19
-
SHA512
7524fb8df27887f6660209378daafe96bc998b912ac2120f0f7e9be53c0358803dd32c68dcadb4f4dde8fc97c645de01df8c9e88f328a3ed3bce08ea57d63c47
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbViSM:UVqoCl/YgjxEufVU0TbTyDDal/M
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4a23f7c70d80bd12a07c463783b72120_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4a23f7c70d80bd12a07c463783b72120_JC.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5b996aa114410a0e39262b9ac281f8c91
SHA19e2da39006de35c0e8f46994ab0e476aeb6454ce
SHA256fde868567575126826550478f4ca4ee33f0cd2017d893c61a8595a0fd9c4ce7b
SHA512db7edbce8cdd968546f36843f447c257ab84ed552c5ae8341bfe245b996f9d57d851a378111b4ead241a042d9ce01d99ce8a422fbfeb31e289ba21f38dcc78e0
-
Filesize
135KB
MD5a91bfbd67fcf83424c7e670b088fbffa
SHA1766831522b4938daef31fd3d6f03e00894d8c2bf
SHA256047457f4282ef49b971c7106a9e80ae28da3f446ca0cd4ae5d95b15fff76b2ac
SHA512c0f75b658801e2875c09153e4469502c2845934e34e20c8420e8f1a676dba35ad711a9b7921e0fc52a2aa6f5df32ac0dc95eaf2105257bd12bd152a71c378da3
-
Filesize
135KB
MD5a91bfbd67fcf83424c7e670b088fbffa
SHA1766831522b4938daef31fd3d6f03e00894d8c2bf
SHA256047457f4282ef49b971c7106a9e80ae28da3f446ca0cd4ae5d95b15fff76b2ac
SHA512c0f75b658801e2875c09153e4469502c2845934e34e20c8420e8f1a676dba35ad711a9b7921e0fc52a2aa6f5df32ac0dc95eaf2105257bd12bd152a71c378da3
-
Filesize
135KB
MD5a91bfbd67fcf83424c7e670b088fbffa
SHA1766831522b4938daef31fd3d6f03e00894d8c2bf
SHA256047457f4282ef49b971c7106a9e80ae28da3f446ca0cd4ae5d95b15fff76b2ac
SHA512c0f75b658801e2875c09153e4469502c2845934e34e20c8420e8f1a676dba35ad711a9b7921e0fc52a2aa6f5df32ac0dc95eaf2105257bd12bd152a71c378da3
-
Filesize
135KB
MD59ad3650be849f4e9fee1487789805702
SHA130e072301ba7c94005929788d47f15b0821e2cd5
SHA256d6220eecb294a769a113b9adbe46302b6e0f44f3b02a7d45c144ac96cf2d7114
SHA5124bffc5dfc48f413cfb0d339b12c6ae1c6a421dae4f72895376b196392c266e7d5f5499f33f754b40174d181f51fde4a1448b9ed1cc8fc3330e11132e48cbc9a5
-
Filesize
135KB
MD5a91bfbd67fcf83424c7e670b088fbffa
SHA1766831522b4938daef31fd3d6f03e00894d8c2bf
SHA256047457f4282ef49b971c7106a9e80ae28da3f446ca0cd4ae5d95b15fff76b2ac
SHA512c0f75b658801e2875c09153e4469502c2845934e34e20c8420e8f1a676dba35ad711a9b7921e0fc52a2aa6f5df32ac0dc95eaf2105257bd12bd152a71c378da3
-
Filesize
135KB
MD59ad3650be849f4e9fee1487789805702
SHA130e072301ba7c94005929788d47f15b0821e2cd5
SHA256d6220eecb294a769a113b9adbe46302b6e0f44f3b02a7d45c144ac96cf2d7114
SHA5124bffc5dfc48f413cfb0d339b12c6ae1c6a421dae4f72895376b196392c266e7d5f5499f33f754b40174d181f51fde4a1448b9ed1cc8fc3330e11132e48cbc9a5
-
Filesize
135KB
MD5b996aa114410a0e39262b9ac281f8c91
SHA19e2da39006de35c0e8f46994ab0e476aeb6454ce
SHA256fde868567575126826550478f4ca4ee33f0cd2017d893c61a8595a0fd9c4ce7b
SHA512db7edbce8cdd968546f36843f447c257ab84ed552c5ae8341bfe245b996f9d57d851a378111b4ead241a042d9ce01d99ce8a422fbfeb31e289ba21f38dcc78e0
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB