Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.01257740b920228e9f70bf1819f91950.exe
Resource
win7-20231023-en
General
-
Target
NEAS.01257740b920228e9f70bf1819f91950.exe
-
Size
176KB
-
MD5
01257740b920228e9f70bf1819f91950
-
SHA1
491bc71fc4ccd8b9a80e11aea17a1bb95a0dc49e
-
SHA256
2f41979ab67b2c8f739147cefcb41008a18e902ee8b531c3017fdbcd1c41291f
-
SHA512
2967ea5af7d9a60994aa11ac1f1125165f207ff5e9a5941fb7e9ff35a6c55ed068db86fa9919b01572bd7c168eaa8ed693b44426623f27ad019228d8bd81d71e
-
SSDEEP
3072:WjdkMa8usOxTBI/j6/aBI8uiSiZjGqMCB5dzaet9MbaWQRTymOS6wJ3kNf:HcAu2CBI8uR0My5Qw6KTy+6wJGf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" NEAS.01257740b920228e9f70bf1819f91950.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NEAS.01257740b920228e9f70bf1819f91950.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe -
Loads dropped DLL 1 IoCs
pid Process 1504 NEAS.01257740b920228e9f70bf1819f91950.exe -
resource yara_rule behavioral1/memory/1504-2-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-3-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-4-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-1-0x00000000022A0000-0x000000000332E000-memory.dmp upx behavioral1/memory/1504-5-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-9-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-11-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-10-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1504-13-0x00000000022A0000-0x000000000332E000-memory.dmp upx behavioral1/memory/1504-14-0x00000000022A0000-0x000000000332E000-memory.dmp upx behavioral1/memory/1504-16-0x00000000022A0000-0x000000000332E000-memory.dmp upx behavioral1/memory/1504-15-0x00000000022A0000-0x000000000332E000-memory.dmp upx behavioral1/memory/1504-17-0x00000000022A0000-0x000000000332E000-memory.dmp upx behavioral1/memory/1504-30-0x00000000022A0000-0x000000000332E000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" NEAS.01257740b920228e9f70bf1819f91950.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NEAS.01257740b920228e9f70bf1819f91950.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI NEAS.01257740b920228e9f70bf1819f91950.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1504 NEAS.01257740b920228e9f70bf1819f91950.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe Token: SeDebugPrivilege 1504 NEAS.01257740b920228e9f70bf1819f91950.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1504 NEAS.01257740b920228e9f70bf1819f91950.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1156 1504 NEAS.01257740b920228e9f70bf1819f91950.exe 15 PID 1504 wrote to memory of 1284 1504 NEAS.01257740b920228e9f70bf1819f91950.exe 14 PID 1504 wrote to memory of 1336 1504 NEAS.01257740b920228e9f70bf1819f91950.exe 13 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NEAS.01257740b920228e9f70bf1819f91950.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\NEAS.01257740b920228e9f70bf1819f91950.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.01257740b920228e9f70bf1819f91950.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1504
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1284
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1156
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06