Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2023, 19:54

General

  • Target

    NEAS.0ac5880cc1862e29e1683a403a64d9d0.exe

  • Size

    210KB

  • MD5

    0ac5880cc1862e29e1683a403a64d9d0

  • SHA1

    d343babf19fe2fd46b504e7aaf67f1b1ca4d8a20

  • SHA256

    cf55ec22d9c296320b624f94156080c872093a47b8018276faffdbb1d47ea042

  • SHA512

    6c50fa07d714a85b9d900f23b678f83765af9e8c989bd51e5ae91f8ba1822b2a1857d52ef97a2b0ca4fc03e1af78daa7e5c76ee5dcc94edd6e64869660b2d7e0

  • SSDEEP

    3072:HfI+O5HNkDxtVagroHSCpNce3oPOM7TC7BbCk+dZpp5bdAXPVaefq4Nxi/3:45YRjBh3C7dULPiPVBg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.0ac5880cc1862e29e1683a403a64d9d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.0ac5880cc1862e29e1683a403a64d9d0.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\BN9G1CWF\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Windows\apppatch\svchost.exe

    Filesize

    210KB

    MD5

    97feefa3bf71665799c905b3196f8e34

    SHA1

    bb34e29af9e96cf9fe8ef5b4297d8c1d93ae8e80

    SHA256

    2d94d6e43a7f474f8863bb8b303cc0150593b0f31f8fd327c7db12f2c2534d89

    SHA512

    d3c16b2b4a1ff4916c72ee65f05d83ba6367b003fe825ff0b68c5f1a3668351ae0b10681667014613bd81101088dc3b09ce5e2a1fdfa28fbd6a6433db268ae71

  • C:\Windows\apppatch\svchost.exe

    Filesize

    210KB

    MD5

    97feefa3bf71665799c905b3196f8e34

    SHA1

    bb34e29af9e96cf9fe8ef5b4297d8c1d93ae8e80

    SHA256

    2d94d6e43a7f474f8863bb8b303cc0150593b0f31f8fd327c7db12f2c2534d89

    SHA512

    d3c16b2b4a1ff4916c72ee65f05d83ba6367b003fe825ff0b68c5f1a3668351ae0b10681667014613bd81101088dc3b09ce5e2a1fdfa28fbd6a6433db268ae71

  • memory/3244-42-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-29-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-14-0x0000000000400000-0x00000000005E3000-memory.dmp

    Filesize

    1.9MB

  • memory/3244-164-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-162-0x0000000000400000-0x00000000005E3000-memory.dmp

    Filesize

    1.9MB

  • memory/3244-19-0x0000000002CF0000-0x0000000002D9A000-memory.dmp

    Filesize

    680KB

  • memory/3244-21-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-23-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-25-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-26-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-27-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-28-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-44-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-30-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-31-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-32-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-35-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-34-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-37-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-41-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-40-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-17-0x0000000002900000-0x0000000002952000-memory.dmp

    Filesize

    328KB

  • memory/3244-18-0x0000000000400000-0x00000000005E3000-memory.dmp

    Filesize

    1.9MB

  • memory/3244-43-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-55-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-50-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-51-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-49-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-53-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-39-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-54-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-47-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-56-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-57-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-58-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-59-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-60-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-61-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-62-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-63-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-64-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/3244-79-0x0000000003100000-0x00000000031B7000-memory.dmp

    Filesize

    732KB

  • memory/4540-2-0x0000000000400000-0x00000000005E3000-memory.dmp

    Filesize

    1.9MB

  • memory/4540-1-0x0000000002380000-0x00000000023D2000-memory.dmp

    Filesize

    328KB

  • memory/4540-0-0x0000000000400000-0x00000000005E3000-memory.dmp

    Filesize

    1.9MB

  • memory/4540-16-0x0000000000400000-0x00000000005E3000-memory.dmp

    Filesize

    1.9MB

  • memory/4540-15-0x0000000002380000-0x00000000023D2000-memory.dmp

    Filesize

    328KB