Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2023, 15:58

General

  • Target

    NEAS.1d216b068ab71ecca2551e8bb57e02d7.exe

  • Size

    19KB

  • MD5

    1d216b068ab71ecca2551e8bb57e02d7

  • SHA1

    f923383e8c0f472822d92513b8e990140555146b

  • SHA256

    a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

  • SHA512

    d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

  • SSDEEP

    384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXKN:rRkiLw3HsDSARGG/6N

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1280
      • C:\Users\Admin\AppData\Local\Temp\NEAS.1d216b068ab71ecca2551e8bb57e02d7.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d216b068ab71ecca2551e8bb57e02d7.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\SysWOW64\rmass.exe
          "C:\Windows\system32\rmass.exe"
          3⤵
          • Windows security bypass
          • Drops file in Drivers directory
          • Modifies Installed Components in the registry
          • Sets file execution options in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Modifies WinLogon
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\SysWOW64\rmass.exe
            --k33p
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2792
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:424

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\RECOVER32.DLL

        Filesize

        5KB

        MD5

        2b2c28a7a01f9584fe220ef84003427f

        SHA1

        5fc023df0b5064045eb8de7f2dbe26f07f6fec70

        SHA256

        9e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb

        SHA512

        39192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78

      • C:\Windows\SysWOW64\ahuy.exe

        Filesize

        21KB

        MD5

        e81d2d61ce596713398dff8188b24c13

        SHA1

        d27030e78f5dc70ad2be802268d8bc3e0e2d2e5c

        SHA256

        300861862cf9eedc8ab587921fcd2d651b3245df91ceb79d63057ffd1dc4d020

        SHA512

        0bd10b1253d0225fff49a162c95315d9ee5d6451e3d0fc79ee253d36b27da033985ba6b9141987967db9e9c14885f1984e62a33807776b3a3183e222ae445fca

      • C:\Windows\SysWOW64\ntdbg.exe

        Filesize

        22KB

        MD5

        db2a8bdea2f1116517743f55786d8275

        SHA1

        b80407f99af886287688831dc6ce14616b77360f

        SHA256

        74db6c47e465a47f4596084c1b2b10eb1d2749d2d78698d692a250a01170fd58

        SHA512

        7acc69be8226b807e80d7822389ba0a6b631804808355546a1402fc6f4d462c67996b3490f7e1f7f9d142d0f59b7e526b4e569ec1cd37249c437d85b1463051c

      • C:\Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • C:\Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • C:\Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • C:\Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • C:\Windows\System32\drivers\etc\hosts

        Filesize

        1KB

        MD5

        b10b13206b0f2cf3968050072f6979bf

        SHA1

        699db21ba9cecf3f13ac3d76e22cfa41aa94da80

        SHA256

        0eef3217095cb97b695c434e74d6314bf9e869a013d6e9c88e58c34576a276b4

        SHA512

        d33bfd931be6676539507a69101d99fa4c5ef36b12422bd11f063b9b6a47b7444f6c4ad5f35e044714fdb872e96cd9fddf049e8329af1219483887f6ac5f4a5d

      • \Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • \Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • \Windows\SysWOW64\rmass.exe

        Filesize

        19KB

        MD5

        1d216b068ab71ecca2551e8bb57e02d7

        SHA1

        f923383e8c0f472822d92513b8e990140555146b

        SHA256

        a4ca4ee77ab1f9535276471ed2ac831421648201771920a4c700c7d307eb459e

        SHA512

        d8c05ac93cd0823acede9deed8e67b13b7fb6a1739c70fe1447c024619a48cc40495fc822e829f34873a4e3bce3a28df80d9ba8e1f5a8ce6b931b7d555bce092

      • memory/2528-22-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2528-52-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2528-25-0x00000000003A0000-0x00000000003B1000-memory.dmp

        Filesize

        68KB

      • memory/2544-11-0x0000000000320000-0x0000000000331000-memory.dmp

        Filesize

        68KB

      • memory/2544-51-0x0000000000320000-0x0000000000331000-memory.dmp

        Filesize

        68KB

      • memory/2544-10-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2544-0-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2792-26-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB