Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05/11/2023, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe
-
Size
1.1MB
-
MD5
b0a43e697a08a26a3b66b0e3387a8ca0
-
SHA1
e99ce2ab72e4bf8a8c20047778e96e00ccea711b
-
SHA256
4dd740b02246b4bf129f70b5d8534a1158064e749506c7863ac97b9bbdc60460
-
SHA512
868f332b0534ce04d48d1bdb2cf167e0c621ff2a62bff94a00afe4f95a99c3b95e5bd7d139c894983bf6201bb258a086ea5d2fb30f37155cd7f0e14a3e4a9c3f
-
SSDEEP
12288:a968cKltpYmtww5o7a0dY71eC+8/yqkOIZHEff7eKgru+CVzSSzM8Gu:abAmtww5o7a0dGD5/yDZIiyo8
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2240 set thread context of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 1676 2644 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2240 wrote to memory of 2644 2240 NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe 29 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30 PID 2644 wrote to memory of 1676 2644 AppLaunch.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b0a43e697a08a26a3b66b0e3387a8ca0_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1963⤵
- Program crash
PID:1676
-
-