Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06/11/2023, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe
-
Size
95KB
-
MD5
12bf6b871fbcf9939c260c3f8346eb10
-
SHA1
27a67ed2d02dfbbb23f51f85065f2703bf1ace99
-
SHA256
8dc0cc2b456f5313f7b4944644bec8d0a06fd9323e30d297fa0383a0ff082916
-
SHA512
faa29620f1a7dcbcf7d3e534180abb6048d7bde8bc4d8768f10cfe5b076ef13f0ed8442852d65452e037e111b7042b86e9b272fa22f29032b1096f1f0067cf92
-
SSDEEP
1536:R1Tzy48untU8fOMEI3jyYfPiuOuXLHnQgrYfYDoXrTlEhm/UrK7:PzltUeOsaIXLQplnlE0/P7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3008 wrote to memory of 480 3008 NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe 29 PID 3008 wrote to memory of 480 3008 NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe 29 PID 3008 wrote to memory of 480 3008 NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe 29 PID 3008 wrote to memory of 480 3008 NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe 29 PID 480 wrote to memory of 1260 480 cmd.exe 30 PID 480 wrote to memory of 1260 480 cmd.exe 30 PID 480 wrote to memory of 1260 480 cmd.exe 30 PID 480 wrote to memory of 1260 480 cmd.exe 30 PID 1260 wrote to memory of 1316 1260 iexpress.exe 31 PID 1260 wrote to memory of 1316 1260 iexpress.exe 31 PID 1260 wrote to memory of 1316 1260 iexpress.exe 31 PID 1260 wrote to memory of 1316 1260 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B1F1.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\NEAS.12bf6b871fbcf9939c260c3f8346eb10.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:1316
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
95KB
MD53c8cf6f6217030eede326ec28b458086
SHA107d1384b6a82a64f85e88acbc9a5da2007bb557c
SHA256b28543667301f074c2f87dee631b1c8320b24912510dc0ccc852f539f4a5fe52
SHA512679f4b4d2b72ed127466679617bccef6f463fd177316729db6dc427918582b8fae4d5494eca03191618e615569ff2ae77f93603d3bc33e5f41b67c1ee765b301
-
Filesize
95KB
MD53c8cf6f6217030eede326ec28b458086
SHA107d1384b6a82a64f85e88acbc9a5da2007bb557c
SHA256b28543667301f074c2f87dee631b1c8320b24912510dc0ccc852f539f4a5fe52
SHA512679f4b4d2b72ed127466679617bccef6f463fd177316729db6dc427918582b8fae4d5494eca03191618e615569ff2ae77f93603d3bc33e5f41b67c1ee765b301
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083