Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
05/11/2023, 07:35 UTC
Behavioral task
behavioral1
Sample
NEAS.ac9958e4a582ae514e4487ec9d273350.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ac9958e4a582ae514e4487ec9d273350.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ac9958e4a582ae514e4487ec9d273350.exe
-
Size
228KB
-
MD5
ac9958e4a582ae514e4487ec9d273350
-
SHA1
a15765543d2c078975823fcebe88cd4b763ad76d
-
SHA256
8668458c8a828b9a801383c149582c15db640d4eb5df60702db207dd2de26f25
-
SHA512
aa512f6d6e898b7a28a5d4130efb3e8e9028dac9698b7b86b01fa0c72af399a10e0341c90123a9692b51dd22b7b2942692cd0b67d2640c4e9b508f7292dd57e8
-
SSDEEP
3072:tIgcTTjAq4wbnBjvxc8287Gw8OUtyjMhTdglu4SUvmre:teAq4wb97KyjsTGxvn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3056 taskserf.exe -
Loads dropped DLL 2 IoCs
pid Process 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe -
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x000e00000000e647-5.dat upx behavioral1/files/0x000e00000000e647-6.dat upx behavioral1/files/0x000e00000000e647-7.dat upx behavioral1/memory/3056-13-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x000e00000000e647-12.dat upx behavioral1/files/0x000e00000000e647-14.dat upx behavioral1/memory/2316-15-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/3056-18-0x0000000000400000-0x000000000043B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskserf.exe = "c:\\users\\admin\\appdata\\local\\temp\\taskserf.exe" NEAS.ac9958e4a582ae514e4487ec9d273350.exe Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskserf.exe = "c:\\users\\admin\\appdata\\local\\temp\\taskserf.exe" NEAS.ac9958e4a582ae514e4487ec9d273350.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3028 2316 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3056 taskserf.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 3056 taskserf.exe 3056 taskserf.exe 3056 taskserf.exe 3056 taskserf.exe 3056 taskserf.exe 3056 taskserf.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2316 wrote to memory of 3056 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 28 PID 2316 wrote to memory of 3056 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 28 PID 2316 wrote to memory of 3056 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 28 PID 2316 wrote to memory of 3056 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 28 PID 2316 wrote to memory of 3028 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 29 PID 2316 wrote to memory of 3028 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 29 PID 2316 wrote to memory of 3028 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 29 PID 2316 wrote to memory of 3028 2316 NEAS.ac9958e4a582ae514e4487ec9d273350.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ac9958e4a582ae514e4487ec9d273350.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ac9958e4a582ae514e4487ec9d273350.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\appdata\local\temp\taskserf.exe"C:\Users\Admin\appdata\local\temp\taskserf.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 4922⤵
- Program crash
PID:3028
-
Network
-
Remote address:8.8.8.8:53Requestmyunknownz.ddns.netIN AResponsemyunknownz.ddns.netIN A100.117.11.2
-
Remote address:8.8.8.8:53Requestmyunknownz.ddns.netIN AResponsemyunknownz.ddns.netIN A100.117.11.2
-
Remote address:8.8.8.8:53Requestmyunknownz.ddns.netIN AResponsemyunknownz.ddns.netIN A100.117.11.2
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
65 B 81 B 1 1
DNS Request
myunknownz.ddns.net
DNS Response
100.117.11.2
-
65 B 81 B 1 1
DNS Request
myunknownz.ddns.net
DNS Response
100.117.11.2
-
65 B 81 B 1 1
DNS Request
myunknownz.ddns.net
DNS Response
100.117.11.2
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD592243b455d362bc982e08e5c68739933
SHA18fb624e123a69fd436cd68951e33f42dd7de4bcb
SHA256a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df
SHA512917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7
-
Filesize
228KB
MD592243b455d362bc982e08e5c68739933
SHA18fb624e123a69fd436cd68951e33f42dd7de4bcb
SHA256a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df
SHA512917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7
-
Filesize
228KB
MD592243b455d362bc982e08e5c68739933
SHA18fb624e123a69fd436cd68951e33f42dd7de4bcb
SHA256a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df
SHA512917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7
-
Filesize
228KB
MD592243b455d362bc982e08e5c68739933
SHA18fb624e123a69fd436cd68951e33f42dd7de4bcb
SHA256a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df
SHA512917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7
-
Filesize
228KB
MD592243b455d362bc982e08e5c68739933
SHA18fb624e123a69fd436cd68951e33f42dd7de4bcb
SHA256a39847886fe37f112882bcba96f084db8f17b6ad089f63233961a7d1833c91df
SHA512917dbc1c330d97317bb37cfd6b560d016eada3947086f2f010b20c1f863e804cfa0bac82eb9bdf4bb6b44fa4a8bc182b3f879dc3e35a18805243aa43bb02aed7