Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2023, 15:01

General

  • Target

    NEAS.4f8d60bbc2d551103de0d39132d14bda_JC.exe

  • Size

    29KB

  • MD5

    4f8d60bbc2d551103de0d39132d14bda

  • SHA1

    27cc3516518ef2b6558a343955918a77a487ed2e

  • SHA256

    0a45794f698e58e8d5ae6e714597d33485bfdfc815fb074170aef5c281bb0173

  • SHA512

    57178e894aabb93da521750b7fa34596319294a8dee8f0cd91558cc8f0c2e0fb82f289c144007051e0d140284bd27f85742f48d33c7c33c5746bf9d6e639d63a

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/ES:AEwVs+0jNDY1qi/qX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4f8d60bbc2d551103de0d39132d14bda_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4f8d60bbc2d551103de0d39132d14bda_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dvusw0miTg.log

    Filesize

    256B

    MD5

    8a7dcfee94d31db80dbd0a3ae71793a0

    SHA1

    2f666866e393b8e5716af932ee359205c3bd5110

    SHA256

    d9c03cb6f22295198068ea1653d6cad5e2216948cbc176d70b3659d212254876

    SHA512

    60a45f67844dddb715682f7f75fd9decf423cf3c3fc77d4775e7a65a81ea751607c4a6a44f28806f70bc28c3a68a30c52d7261ed9edc65a54387f7c8b515c4a1

  • C:\Users\Admin\AppData\Local\Temp\tmpC53D.tmp

    Filesize

    29KB

    MD5

    c4c5e9726097023343bc5314651e4515

    SHA1

    b537d71f24b99fa5e51c3a1dfc7aac6b9324ed75

    SHA256

    9d3f44d2af148037f5388ade849c9e6ad8c713bf987f1950e0c158c2b3d0adc0

    SHA512

    9ca2d9efa7773a6c435a79e054857b24a63065ad143b0c96b1846cbb294fa410021fb2956ba6180b3475de1ec457387c22abd7a3fd25e5066b3b742fcdee7c26

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    4d1707431d58e9dafda59bfcb30bc689

    SHA1

    706cd7f98efef2aec93015d1dbcd28696d087da5

    SHA256

    991f17d5434bbbdc3c288588d79617f2ea43b11dbf6dc84504523519ec9ee81d

    SHA512

    e55532e3b4a4fb6c22bfbaa4b7989c7dbe5ea899fc7ea520fa765851b1b4bd1fb26c7c1652d746f5bd09d9839239d1ebf5ba9ade3b69cc0532e295cd7b4a9baa

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2348-198-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2348-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2348-193-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2348-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2348-191-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2348-84-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3528-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-52-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-192-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-194-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-7-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3528-199-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB