Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

NEAS.4ffeb...e0.exe

windows7-x64

7

NEAS.4ffeb...e0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 02:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.4ffeb2f74d04992f1862f9d569b9d6e0.exe

  • Size

    6.7MB

  • MD5

    4ffeb2f74d04992f1862f9d569b9d6e0

  • SHA1

    eee034ba11a5c4ca0a18dd1d40044ced24884e70

  • SHA256

    af5ffa925f2760bd49159031b6a76949ef6f6e025e98bfcb411492dbc3e432b0

  • SHA512

    8d43ec5335ece0f9c6c322df68e29e4449522284218371a857f93b7171cb7b7db58c36440502c88769a2d94582e4167f90216878aa567e80e4f0ae47cec36e7b

  • SSDEEP

    98304:kyzTX4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqtvsJ1YPwINk:kMX4FMIZETKwjPePdrQJ/BNOq2YPL

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4ffeb2f74d04992f1862f9d569b9d6e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4ffeb2f74d04992f1862f9d569b9d6e0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Local\Temp\NEAS.4ffeb2f74d04992f1862f9d569b9d6e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4ffeb2f74d04992f1862f9d569b9d6e0.exe"
      2⤵
      • Loads dropped DLL
      PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\VCRUNTIME140.dll
    Filesize

    106KB

    MD5

    4585a96cc4eef6aafd5e27ea09147dc6

    SHA1

    489cfff1b19abbec98fda26ac8958005e88dd0cb

    SHA256

    a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

    SHA512

    d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\VCRUNTIME140.dll
    Filesize

    106KB

    MD5

    4585a96cc4eef6aafd5e27ea09147dc6

    SHA1

    489cfff1b19abbec98fda26ac8958005e88dd0cb

    SHA256

    a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

    SHA512

    d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\_socket.pyd
    Filesize

    77KB

    MD5

    1eea9568d6fdef29b9963783827f5867

    SHA1

    a17760365094966220661ad87e57efe09cd85b84

    SHA256

    74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117

    SHA512

    d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\_socket.pyd
    Filesize

    77KB

    MD5

    1eea9568d6fdef29b9963783827f5867

    SHA1

    a17760365094966220661ad87e57efe09cd85b84

    SHA256

    74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117

    SHA512

    d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\base_library.zip
    Filesize

    1.8MB

    MD5

    e17ce7183e682de459eec1a5ac9cbbff

    SHA1

    722968ca6eb123730ebc30ff2d498f9a5dad4cc1

    SHA256

    ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d

    SHA512

    fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\python311.dll
    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\python311.dll
    Filesize

    5.5MB

    MD5

    5a5dd7cad8028097842b0afef45bfbcf

    SHA1

    e247a2e460687c607253949c52ae2801ff35dc4a

    SHA256

    a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

    SHA512

    e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\select.pyd
    Filesize

    29KB

    MD5

    c97a587e19227d03a85e90a04d7937f6

    SHA1

    463703cf1cac4e2297b442654fc6169b70cfb9bf

    SHA256

    c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf

    SHA512

    97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\select.pyd
    Filesize

    29KB

    MD5

    c97a587e19227d03a85e90a04d7937f6

    SHA1

    463703cf1cac4e2297b442654fc6169b70cfb9bf

    SHA256

    c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf

    SHA512

    97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    aa13ee6770452af73828b55af5cd1a32

    SHA1

    c01ece61c7623e36a834d8b3c660e7f28c91177e

    SHA256

    8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb

    SHA512

    b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI15602\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    aa13ee6770452af73828b55af5cd1a32

    SHA1

    c01ece61c7623e36a834d8b3c660e7f28c91177e

    SHA256

    8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb

    SHA512

    b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f

    Download Submit