Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe
-
Size
210KB
-
MD5
5cb284c09e558a41613ecfb1eeaa52d0
-
SHA1
1ebf46ee09b9b176f93bf2d14aca89ab68ebf20b
-
SHA256
89aa5e637a8d5807124af1640505a1515e9b41f9d8bd1e3eba043955be8353fb
-
SHA512
e1097854af838009b4dae3d540796b369482b9ff43f01d5222a4f24f90cb33df8ba8826c9dc7d4edced9eb039e8c877bdbbba030d431a020f3ddaeb063bdcb25
-
SSDEEP
6144:JljIxNJrVSnu78/LTlKh5/ICQ6Sojhvo6mWoj:QJhSnWQCQ6So9QdHj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 484 u.dll 2720 u.dll 2628 mpress.exe -
Loads dropped DLL 6 IoCs
pid Process 1688 cmd.exe 1688 cmd.exe 1688 cmd.exe 1688 cmd.exe 2720 u.dll 2720 u.dll -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1688 1968 NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe 29 PID 1968 wrote to memory of 1688 1968 NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe 29 PID 1968 wrote to memory of 1688 1968 NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe 29 PID 1968 wrote to memory of 1688 1968 NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe 29 PID 1688 wrote to memory of 484 1688 cmd.exe 30 PID 1688 wrote to memory of 484 1688 cmd.exe 30 PID 1688 wrote to memory of 484 1688 cmd.exe 30 PID 1688 wrote to memory of 484 1688 cmd.exe 30 PID 1688 wrote to memory of 2720 1688 cmd.exe 31 PID 1688 wrote to memory of 2720 1688 cmd.exe 31 PID 1688 wrote to memory of 2720 1688 cmd.exe 31 PID 1688 wrote to memory of 2720 1688 cmd.exe 31 PID 2720 wrote to memory of 2628 2720 u.dll 32 PID 2720 wrote to memory of 2628 2720 u.dll 32 PID 2720 wrote to memory of 2628 2720 u.dll 32 PID 2720 wrote to memory of 2628 2720 u.dll 32 PID 1688 wrote to memory of 524 1688 cmd.exe 33 PID 1688 wrote to memory of 524 1688 cmd.exe 33 PID 1688 wrote to memory of 524 1688 cmd.exe 33 PID 1688 wrote to memory of 524 1688 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7224.tmp\vir.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save NEAS.5cb284c09e558a41613ecfb1eeaa52d0_JC.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
PID:484
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\83FF.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe8400.tmp"4⤵
- Executes dropped EXE
PID:2628
-
-
-
C:\Windows\SysWOW64\calc.exeCALC.EXE3⤵PID:524
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55b000f53b65dce7d504394d5125bf9b1
SHA1dedb6896533f3763c764cc6a8ae8b98bd9dbd87d
SHA2564e589850643050375a41553ca33deab80e7f72d1521796f4d3b1ff195b9845d6
SHA512ca6c1bb30b4f386363b1e03be3da0f91ce3e2f16b558c389da910e564343b7857a596fc6d71eb79b94dea0ec3a947d5136590e9446b0b39bf36db5ba311cef89
-
Filesize
1KB
MD55b000f53b65dce7d504394d5125bf9b1
SHA1dedb6896533f3763c764cc6a8ae8b98bd9dbd87d
SHA2564e589850643050375a41553ca33deab80e7f72d1521796f4d3b1ff195b9845d6
SHA512ca6c1bb30b4f386363b1e03be3da0f91ce3e2f16b558c389da910e564343b7857a596fc6d71eb79b94dea0ec3a947d5136590e9446b0b39bf36db5ba311cef89
-
Filesize
100KB
MD5e42b81b9636152c78ba480c1c47d3c7f
SHA166a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA2567c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
SHA5124b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e
-
Filesize
100KB
MD5e42b81b9636152c78ba480c1c47d3c7f
SHA166a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA2567c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
SHA5124b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e
-
Filesize
41KB
MD5bfffa6c36b0aa15510a443a79382ede1
SHA1af44603bd5cad266d5e1b681691c56a25b603e58
SHA25654cc6b298d45fffa6b9198fa5d4b5793c6248f887feaed2b928c6c400fb7a22b
SHA512381efd97ac75a95ec229955d82d6d4fc9019de88ecf7f58e9f550dd4a002d57ce03983dfdb3286782685d15740388e2d0bd6de50753a0b224dae10b0ebcda486
-
Filesize
25KB
MD58d308637cf8cb4e76f91b18e06a81ada
SHA1a1710293fb17884b55d87e83aa4ced3af81eca55
SHA256eb198a36b4f250d2ef8b44235960e4b1618dd60b49e93c1d2c42f090b587f661
SHA5129d3869032c8371169824a1417c53a3a4d57d714871f3dc356dc78317c4b78b151b248b235f6057431f510e143c90c2d0c977285709b2feb803681e9be9fbcc75
-
Filesize
41KB
MD57b1d4881dc73906ac31bf9d7865df73d
SHA1a6f1239420a24da767551259556ca3e374c49887
SHA256a9cf9751c195c7f214c38d7e5a7308bf900b097a7341435c44eed65f3e751c0e
SHA512135968f385986f363a596823d52b17fc8cc48173bb531c300d48325c61350471f7b1769cb7397ffd11c4a5e647896d2cf0f3a50b28ef4ea456b666793af743fa
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
1KB
MD591bbf94ced9f347112b00fdd2d80cb6e
SHA1b65d9fad1d34ba35ba85df78c7b65c5ed92e7614
SHA256924a8f53986de55507660b793577589ef8f2abfb1d6e5dfc5b224fbee9b3856b
SHA51270c87f6948f9782f479491c5648c283a648a03497324feba7fd52790ff248af2b0837c4740af32cc778a1c651759c52c6db8a15ab3d6d0a136cf24f697960581
-
Filesize
1KB
MD5a4aad89ce46894da3f4e556e78008592
SHA1c5d60d84b65f545dd73cd8bd67e35bc440b1b638
SHA256b6af4b2865c63cf2fb92882894312d893dcbfe13d85568f8cb4b99f7a2b237af
SHA51272fca832de18832fd9235c45458b7418989c1feaf7928871ded2fb81f554d4c28b81e931fbed17d0b8917785ac43d458bd2ddba3a2041571470f056acb9ce864
-
Filesize
100KB
MD5e42b81b9636152c78ba480c1c47d3c7f
SHA166a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA2567c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
SHA5124b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e
-
Filesize
100KB
MD5e42b81b9636152c78ba480c1c47d3c7f
SHA166a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA2567c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
SHA5124b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133
-
Filesize
700KB
MD503cfde8f9aa4a9e26520da9a85faca40
SHA145a3dc2ab8aa420c19922b1783a9f19e695da4e6
SHA25693a3c30195dc710c1469f5fd364fe3e1866878b0055ee942ef23c19602664379
SHA512e264531bbb9912785010f0368627937d33a6173e8c5b7b7d8f15809c018e2cfd799ec6182ecdb17f3f98c142b3bc0b475c1e625febd14805f7ff9a68ad6b2133