Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
05/11/2023, 21:05
General
-
Target
NEAS.841923b897b7ebe6147d11851fd74520.exe
-
Size
234KB
-
MD5
841923b897b7ebe6147d11851fd74520
-
SHA1
429c081376975817aa7ef97838cf1a71ed0b063e
-
SHA256
f98eb39941eb5078d53a5cb1c00c780de967301801adb503d98dd2ceb2968071
-
SHA512
fb2ca9388bd326a3a4602044db19df27ac1eb35defef46848223b50bd3047503db9350825c7ecede880c38282ef8cdaeec5dc7c383a6d4d2a525e2076246c461
-
SSDEEP
6144:NwU5hNJJRdxRqOP/sF4QErFfnFR4ropS+O+MrCFRo5X4XQIQ4:Nw6RnP/sZ8FQTmt
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\NEAS.841923b897b7ebe6147d11851fd74520.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.841923b897b7ebe6147d11851fd74520.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RdpStar\ktmuient.exe"C:\Users\Admin\AppData\Roaming\RdpStar"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~8E65.tmp3312 239624 916 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\dialdstr.exeC:\Windows\SysWOW64\dialdstr.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
234KB
MD581c795a4994a521d1769d16474cb2d20
SHA1675bcbcd7a6657b1705430dd541c390ce005b94b
SHA2565f972702e16ca63adbf2e6c73a1a416fc3e9c24618c57c6bf696aa678532dcd1
SHA51200233ea3ae1965a82dd6c1f00df2bc4ca4253cdc1451539b668b163fd27946646cecd58fd2e94d5a8c3f18341e40e543efe7cfffd299ed4d1ebf6dc00022208d
-
Filesize
234KB
MD581c795a4994a521d1769d16474cb2d20
SHA1675bcbcd7a6657b1705430dd541c390ce005b94b
SHA2565f972702e16ca63adbf2e6c73a1a416fc3e9c24618c57c6bf696aa678532dcd1
SHA51200233ea3ae1965a82dd6c1f00df2bc4ca4253cdc1451539b668b163fd27946646cecd58fd2e94d5a8c3f18341e40e543efe7cfffd299ed4d1ebf6dc00022208d
-
Filesize
234KB
MD581c795a4994a521d1769d16474cb2d20
SHA1675bcbcd7a6657b1705430dd541c390ce005b94b
SHA2565f972702e16ca63adbf2e6c73a1a416fc3e9c24618c57c6bf696aa678532dcd1
SHA51200233ea3ae1965a82dd6c1f00df2bc4ca4253cdc1451539b668b163fd27946646cecd58fd2e94d5a8c3f18341e40e543efe7cfffd299ed4d1ebf6dc00022208d
-
Filesize
234KB
MD581c795a4994a521d1769d16474cb2d20
SHA1675bcbcd7a6657b1705430dd541c390ce005b94b
SHA2565f972702e16ca63adbf2e6c73a1a416fc3e9c24618c57c6bf696aa678532dcd1
SHA51200233ea3ae1965a82dd6c1f00df2bc4ca4253cdc1451539b668b163fd27946646cecd58fd2e94d5a8c3f18341e40e543efe7cfffd299ed4d1ebf6dc00022208d
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
268KB
-
Filesize
20KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
268KB
-
Filesize
268KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
252KB