Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2023, 19:36

General

  • Target

    NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe

  • Size

    132KB

  • MD5

    8e7e9d1c9326f41fee568ee4116fea40

  • SHA1

    aaea7f6941ce7f38c0786fb09b4c81c0a83148e3

  • SHA256

    29740d4105c254541a4abc8d4b60786cf0b6383f5fd314e1bd355ce0a7a0b4f1

  • SHA512

    4a99cebbbe3b0f3a0bb49f532ab2e65b8ca34183d04bff783fe9fd2e8a73c095bf586ea0ba1dd67be731f910cb83a4967700dfc416c72d7853d2fe83de1fb146

  • SSDEEP

    3072:5FgJNhlzUMdc6+adSAs7uxzjaT36bvkTda6vWyQ7BCdhk:5FgrzUM66+adOOa7GuW77Ghk

Score
8/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.8e7e9d1c9326f41fee568ee4116fea40_JC.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2072
  • C:\PROGRA~3\Mozilla\asqmzyj.exe
    C:\PROGRA~3\Mozilla\asqmzyj.exe -kewnvcd
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:3948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\asqmzyj.exe

    Filesize

    132KB

    MD5

    e59156defd65da6d46c938271410b30f

    SHA1

    ef029017c2b0a8039f4f5a6974bbdd6fb9c0f879

    SHA256

    26f2c3f312f08656814312face6aae00a517c50e224762535134d08d73571fe8

    SHA512

    e05d5f40bc816709632c2e239d3e977bccf0dd75686dc3c19a687e1f37ac2f480a8dfb911693ab3adf5f29f96f182891c3cd080d0022483819bd4a8cccdfe910

  • C:\ProgramData\Mozilla\asqmzyj.exe

    Filesize

    132KB

    MD5

    e59156defd65da6d46c938271410b30f

    SHA1

    ef029017c2b0a8039f4f5a6974bbdd6fb9c0f879

    SHA256

    26f2c3f312f08656814312face6aae00a517c50e224762535134d08d73571fe8

    SHA512

    e05d5f40bc816709632c2e239d3e977bccf0dd75686dc3c19a687e1f37ac2f480a8dfb911693ab3adf5f29f96f182891c3cd080d0022483819bd4a8cccdfe910

  • memory/2072-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2072-1-0x0000000002600000-0x000000000265B000-memory.dmp

    Filesize

    364KB

  • memory/2072-10-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/3948-9-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/3948-11-0x00000000007D0000-0x000000000082B000-memory.dmp

    Filesize

    364KB

  • memory/3948-17-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB