Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
07/11/2023, 02:12
General
-
Target
NEAS.f48fde7e540a888f7cf73e607cf32dc0.exe
-
Size
1.2MB
-
MD5
f48fde7e540a888f7cf73e607cf32dc0
-
SHA1
368b7e840e5e028be9e94e3c85a454fe16b2e2ec
-
SHA256
1695315c0df6acabe55a5fce3a7fb42f904696512a17078bf6c3b99bdf2ab485
-
SHA512
a5c076d1e31f8063264be148fb467ba4e9414fedba0aa0055094cf8581d40d170f8883507f1a7fb3d94216969cb61b5697182494c6a753de01fe32f5bee04e55
-
SSDEEP
24576:6nZaHEunzpoeb2JDMXVv4jg1y+cjvA/RnWp7SnXi2zxkqq:iak8pLbkI54jUyno/R3Xi2iqq
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f48fde7e540a888f7cf73e607cf32dc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f48fde7e540a888f7cf73e607cf32dc0.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD56389a342aac7831d19f450a82480ed7f
SHA1e25f3f108296274ca316f04e496f5d79c7f9fa02
SHA256d7fa054c01e8a986a579978f712c2fbfd52c5e5b7a4535499039314544104b1f
SHA5128c309103c34604993ea9fc97eea59caeb477aaa685e9d847b109231fd2749e7a064f11a4497a3c02ad7b222f393f4bcaed9526f02da3665ac03f9e5472f26fed
-
Filesize
1.2MB
MD5b357e2ac4967d54f829aeffc8b49e72f
SHA1a3fa17f8ff293b57296396fb8c8a8cbc7143e1b6
SHA256b54ecf36eb6a98312f45cb900334b36c2326235fc4ea3ec873a2479878447b11
SHA512b7d312ebf25a4292a53ee1e30ce04ae273678d268a4df808b99565750941c40eed6919f42d6a8554d146a48644a4541eeaef78c6f477446f1476d8f44ff0af61
-
Filesize
1.2MB
MD5b357e2ac4967d54f829aeffc8b49e72f
SHA1a3fa17f8ff293b57296396fb8c8a8cbc7143e1b6
SHA256b54ecf36eb6a98312f45cb900334b36c2326235fc4ea3ec873a2479878447b11
SHA512b7d312ebf25a4292a53ee1e30ce04ae273678d268a4df808b99565750941c40eed6919f42d6a8554d146a48644a4541eeaef78c6f477446f1476d8f44ff0af61
-
Filesize
1.2MB
MD5b357e2ac4967d54f829aeffc8b49e72f
SHA1a3fa17f8ff293b57296396fb8c8a8cbc7143e1b6
SHA256b54ecf36eb6a98312f45cb900334b36c2326235fc4ea3ec873a2479878447b11
SHA512b7d312ebf25a4292a53ee1e30ce04ae273678d268a4df808b99565750941c40eed6919f42d6a8554d146a48644a4541eeaef78c6f477446f1476d8f44ff0af61
-
Filesize
1.2MB
MD59f79dd4daa5619a1f47582fbe5286ea4
SHA18484d1acb01bb072f3a9cb0f78f038eeb17b517e
SHA256f44bc26a40a9efbc68d2af8890add9e94ac63be704d0319ee81f66409d28bdaa
SHA512816f1d483c4ac84126853252718ec7b9240799867432422ee7b30d16797948de323f9324a11c9e687ac70a482503c053e20aaf3ffffc67f216b0423d451b4250
-
Filesize
1.2MB
MD5b357e2ac4967d54f829aeffc8b49e72f
SHA1a3fa17f8ff293b57296396fb8c8a8cbc7143e1b6
SHA256b54ecf36eb6a98312f45cb900334b36c2326235fc4ea3ec873a2479878447b11
SHA512b7d312ebf25a4292a53ee1e30ce04ae273678d268a4df808b99565750941c40eed6919f42d6a8554d146a48644a4541eeaef78c6f477446f1476d8f44ff0af61
-
Filesize
1.2MB
MD59f79dd4daa5619a1f47582fbe5286ea4
SHA18484d1acb01bb072f3a9cb0f78f038eeb17b517e
SHA256f44bc26a40a9efbc68d2af8890add9e94ac63be704d0319ee81f66409d28bdaa
SHA512816f1d483c4ac84126853252718ec7b9240799867432422ee7b30d16797948de323f9324a11c9e687ac70a482503c053e20aaf3ffffc67f216b0423d451b4250
-
Filesize
1.2MB
MD56389a342aac7831d19f450a82480ed7f
SHA1e25f3f108296274ca316f04e496f5d79c7f9fa02
SHA256d7fa054c01e8a986a579978f712c2fbfd52c5e5b7a4535499039314544104b1f
SHA5128c309103c34604993ea9fc97eea59caeb477aaa685e9d847b109231fd2749e7a064f11a4497a3c02ad7b222f393f4bcaed9526f02da3665ac03f9e5472f26fed
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB