Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

NEAS.4a635...c0.exe

windows7-x64

10

NEAS.4a635...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe

  • Size

    204KB

  • Sample

    231104-rg93xsdb39

  • MD5

    4a635c77d44a596ef0b5c0e38c05d9c0

  • SHA1

    20515e905b52ea2021e3e43aa7fb4801e480e57e

  • SHA256

    2c19efe945a9b183be41c2db5b883cae7156fe01a37376305f47bc5af299fb79

  • SHA512

    8fc31cb56602adc80ef0a575fe20ee27756a6824a64aad155a05d071a2f24d30516138600e82a8175434aed8d99d2af0861d97edc9e1794ff75967b6e54f6f1e

  • SSDEEP

    3072:QmRW8MDaO0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWr5:rAFmO4QxL7B9W0c1RCzR/fSmlY

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      NEAS.4a635c77d44a596ef0b5c0e38c05d9c0.exe

    • Size

      204KB

    • MD5

      4a635c77d44a596ef0b5c0e38c05d9c0

    • SHA1

      20515e905b52ea2021e3e43aa7fb4801e480e57e

    • SHA256

      2c19efe945a9b183be41c2db5b883cae7156fe01a37376305f47bc5af299fb79

    • SHA512

      8fc31cb56602adc80ef0a575fe20ee27756a6824a64aad155a05d071a2f24d30516138600e82a8175434aed8d99d2af0861d97edc9e1794ff75967b6e54f6f1e

    • SSDEEP

      3072:QmRW8MDaO0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWr5:rAFmO4QxL7B9W0c1RCzR/fSmlY

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks