Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.62b8f97e157876087f43b5096a8bda00.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.62b8f97e157876087f43b5096a8bda00.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.62b8f97e157876087f43b5096a8bda00.exe
-
Size
103KB
-
MD5
62b8f97e157876087f43b5096a8bda00
-
SHA1
a011cce6121d09b085df5214b3bb68a32e82889d
-
SHA256
4114b07816556643bea1953ee9923c61614342971388f2c63ae104e91471d361
-
SHA512
b01f501c11aa2b4d399b923e9032128754d9168cb707c0589663013e14ea175dba73df401fc1ecc5e9dd2e30676e92786de65d3a0e4ce03fb4ffae323451d02a
-
SSDEEP
1536:4aiqH1s+kCtrA2UMT0mTFibDKa1Xohs60VHRxc17TJIbas6SebVurUMM8:51B31bdBob2QXowVHCqT6S6AUMM8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" NEAS.62b8f97e157876087f43b5096a8bda00.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX30A2.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX30C2.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3102.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3163.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3143.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3183.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX31C2.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3122.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3101.tmp NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\sIRC4.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\mip.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe NEAS.62b8f97e157876087f43b5096a8bda00.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
568KB
MD5fe795fe0d6ddb8a0f462c3cd713fc662
SHA1bfc7359433d98fda8a267bc535bc3698101b18a3
SHA2563415f0dcec61ac6e8d388e25cc0fc819c6f8a4513b81519c8d399680fbf916ee
SHA512022f0038b454482bad7009257e17c5e4e7edfe5707ea68940b668196eafcfa77cf1a1b320e2d7303bd8313d792f3ba86a8da7bcf3f085aebe0e35a4bb7ce2123