Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    05/11/2023, 07:35 UTC

General

  • Target

    NEAS.ac9958e4a582ae514e4487ec9d273350.exe

  • Size

    228KB

  • MD5

    ac9958e4a582ae514e4487ec9d273350

  • SHA1

    a15765543d2c078975823fcebe88cd4b763ad76d

  • SHA256

    8668458c8a828b9a801383c149582c15db640d4eb5df60702db207dd2de26f25

  • SHA512

    aa512f6d6e898b7a28a5d4130efb3e8e9028dac9698b7b86b01fa0c72af399a10e0341c90123a9692b51dd22b7b2942692cd0b67d2640c4e9b508f7292dd57e8

  • SSDEEP

    3072:tIgcTTjAq4wbnBjvxc8287Gw8OUtyjMhTdglu4SUvmre:teAq4wb97KyjsTGxvn

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.ac9958e4a582ae514e4487ec9d273350.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.ac9958e4a582ae514e4487ec9d273350.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\appdata\local\temp\taskserf.exe
      "C:\Users\Admin\appdata\local\temp\taskserf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 492
      2⤵
      • Program crash
      PID:3028

Network

  • flag-us
    DNS
    myunknownz.ddns.net
    taskserf.exe
    Remote address:
    8.8.8.8:53
    Request
    myunknownz.ddns.net
    IN A
    Response
    myunknownz.ddns.net
    IN A
    100.117.11.2
  • flag-us
    DNS
    myunknownz.ddns.net
    taskserf.exe
    Remote address:
    8.8.8.8:53
    Request
    myunknownz.ddns.net
    IN A
    Response
    myunknownz.ddns.net
    IN A
    100.117.11.2
  • flag-us
    DNS
    myunknownz.ddns.net
    taskserf.exe
    Remote address:
    8.8.8.8:53
    Request
    myunknownz.ddns.net
    IN A
    Response
    myunknownz.ddns.net
    IN A
    100.117.11.2
  • 100.117.11.2:26025
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26024
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26025
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26024
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26025
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26025
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26024
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26025
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26024
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 100.117.11.2:26025
    myunknownz.ddns.net
    taskserf.exe
    152 B
    3
  • 8.8.8.8:53
    myunknownz.ddns.net
    dns
    taskserf.exe
    65 B
    81 B
    1
    1

    DNS Request

    myunknownz.ddns.net

    DNS Response

    100.117.11.2

  • 8.8.8.8:53
    myunknownz.ddns.net
    dns
    taskserf.exe
    65 B
    81 B
    1
    1

    DNS Request

    myunknownz.ddns.net

    DNS Response

    100.117.11.2

  • 8.8.8.8:53
    myunknownz.ddns.net
    dns
    taskserf.exe
    65 B
    81 B
    1
    1

    DNS Request

    myunknownz.ddns.net

    DNS Response

    100.117.11.2

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\taskserf.exe

    Filesize

    228KB

    MD5

    92243b455d362bc982e08e5c68739933

    SHA1

    8fb624e123a69fd436cd68951e33f42dd7de4bcb

    SHA256

    a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df

    SHA512

    917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7

  • C:\Users\Admin\AppData\Local\Temp\taskserf.exe

    Filesize

    228KB

    MD5

    92243b455d362bc982e08e5c68739933

    SHA1

    8fb624e123a69fd436cd68951e33f42dd7de4bcb

    SHA256

    a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df

    SHA512

    917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7

  • C:\Users\Admin\appdata\local\temp\taskserf.exe

    Filesize

    228KB

    MD5

    92243b455d362bc982e08e5c68739933

    SHA1

    8fb624e123a69fd436cd68951e33f42dd7de4bcb

    SHA256

    a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df

    SHA512

    917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7

  • \Users\Admin\AppData\Local\Temp\taskserf.exe

    Filesize

    228KB

    MD5

    92243b455d362bc982e08e5c68739933

    SHA1

    8fb624e123a69fd436cd68951e33f42dd7de4bcb

    SHA256

    a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df

    SHA512

    917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7

  • \Users\Admin\AppData\Local\Temp\taskserf.exe

    Filesize

    228KB

    MD5

    92243b455d362bc982e08e5c68739933

    SHA1

    8fb624e123a69fd436cd68951e33f42dd7de4bcb

    SHA256

    a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df

    SHA512

    917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7

  • memory/2316-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2316-11-0x00000000025E0000-0x000000000261B000-memory.dmp

    Filesize

    236KB

  • memory/2316-15-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2316-16-0x00000000025E0000-0x000000000261B000-memory.dmp

    Filesize

    236KB

  • memory/2316-17-0x00000000025E0000-0x000000000261B000-memory.dmp

    Filesize

    236KB

  • memory/3056-13-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3056-18-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.