Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2023, 08:33

General

  • Target

    NEAS.54417c8f7f43071297055210009dbd70.exe

  • Size

    212KB

  • MD5

    54417c8f7f43071297055210009dbd70

  • SHA1

    a32e74221460a3aa11e9c74fd6191142200807ae

  • SHA256

    49d0d16b61e9b568f34e9ea12ce970e51faeaf190590199f7898484c83ba69ae

  • SHA512

    39476684e545a7be108a71c812d1e191b359b96fb5f2901f77f6cb9a9464a6c436b8528a66129e1e12f0342feb28f4e1ca574f3137fc095747df258a11aa3c4f

  • SSDEEP

    6144:p44b7czAEYdlyp6rswaDqKgL08qvFsRcB:m4fiQdlnoxgYlvy+

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.54417c8f7f43071297055210009dbd70.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.54417c8f7f43071297055210009dbd70.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:3004
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {BAB3304F-5725-4D5C-A151-C748F97AF8D8} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\PROGRA~3\Mozilla\kymnayk.exe
      C:\PROGRA~3\Mozilla\kymnayk.exe -dtmxjcd
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\kymnayk.exe

    Filesize

    212KB

    MD5

    ec34dd3693566263c6ed63cd3f877e3b

    SHA1

    f4280b52cb7b83b8cd7b7973ec696f7ab0dbe59b

    SHA256

    a810971df96b06949f8781dc138073f7da016c255566b429b90465ff488ef541

    SHA512

    d48b2577a410392a99a2d66384e4bf7a9e0cdc5609b7e2291279664cab6930fd4a130309427cb958c3ff787914de5e13f19654c27e7b89eee5216b3f23dfac02

  • C:\PROGRA~3\Mozilla\kymnayk.exe

    Filesize

    212KB

    MD5

    ec34dd3693566263c6ed63cd3f877e3b

    SHA1

    f4280b52cb7b83b8cd7b7973ec696f7ab0dbe59b

    SHA256

    a810971df96b06949f8781dc138073f7da016c255566b429b90465ff488ef541

    SHA512

    d48b2577a410392a99a2d66384e4bf7a9e0cdc5609b7e2291279664cab6930fd4a130309427cb958c3ff787914de5e13f19654c27e7b89eee5216b3f23dfac02

  • memory/2704-7-0x00000000008F0000-0x000000000094B000-memory.dmp

    Filesize

    364KB

  • memory/2704-8-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2704-10-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2704-11-0x00000000008F0000-0x000000000094B000-memory.dmp

    Filesize

    364KB

  • memory/3004-1-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/3004-0-0x00000000004D0000-0x000000000052B000-memory.dmp

    Filesize

    364KB

  • memory/3004-3-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/3004-4-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB