Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2023, 04:14

General

  • Target

    NEAS.14d43fb01192799c110a8b14bca88690.exe

  • Size

    37KB

  • MD5

    14d43fb01192799c110a8b14bca88690

  • SHA1

    4284b799ac52305b1eb07f4497fecdc4a8573731

  • SHA256

    373a968efbb90601e5c6463fdc8a4531a25f4a7c27979b6376edb6b45ba0de06

  • SHA512

    217dbe1ebc563f2452131e8e326fb626e6a48f622f55e967d27c9d7e5b54261e2404a92144ec56c59ab40df6308ad63fafa491b7ea47936f636236687afd479e

  • SSDEEP

    768:w8RW/w+EltMIaTsNaQr+SDO4jnzdNE9dZydalfuV3lVwP1DnM:waW/lDSaKHzLE9dOaFufVw9LM

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.14d43fb01192799c110a8b14bca88690.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14d43fb01192799c110a8b14bca88690.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C WMIC OS get Caption,OSArchitecture,Version /Format:table & WMIC BIOS Get Manufacturer,Name /Format:table & WMIC Baseboard Get Product,Manufacturer /Format:table & WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors /Format:table & WMIC Memorychip Get Manufacturer,Capacity,Speed,PartNumber /Format:table & WMIC Diskdrive Get Model,Size /Format:table & WMIC Path Win32_VideoController get Caption,VideoModeDescription /Format:table & WMIC netuse get Name /Format:table
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC OS get Caption,OSArchitecture,Version /Format:table
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2832
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC BIOS Get Manufacturer,Name /Format:table
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC Baseboard Get Product,Manufacturer /Format:table
        3⤵
          PID:1276
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC CPU Get Name,NumberOfCores,NumberOfLogicalProcessors /Format:table
          3⤵
            PID:2732
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC Memorychip Get Manufacturer,Capacity,Speed,PartNumber /Format:table
            3⤵
              PID:2592
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC Diskdrive Get Model,Size /Format:table
              3⤵
                PID:2544
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC Path Win32_VideoController get Caption,VideoModeDescription /Format:table
                3⤵
                  PID:2580
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC netuse get Name /Format:table
                  3⤵
                    PID:2648

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                Filesize

                344B

                MD5

                cf7231d89827b5006018ecc207ed6d7e

                SHA1

                4acf6168812664a8330fa1d6ad09b65885c41d07

                SHA256

                8c2e2e317f9f6595446501659109f5fb0e58b999c81fe9fcad9c8fbed0f36d8a

                SHA512

                fa22e8d482b319213ae0496f5a2c1818ff52005555f007ad6e35514e7431ea1ccc03a868669e7c21665d8eee88505980c880f040e2500382a320171b4afdf2b8

              • C:\Users\Admin\AppData\Local\Temp\Cab4C6D.tmp

                Filesize

                61KB

                MD5

                f3441b8572aae8801c04f3060b550443

                SHA1

                4ef0a35436125d6821831ef36c28ffaf196cda15

                SHA256

                6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

                SHA512

                5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

              • C:\Users\Admin\AppData\Local\Temp\Tar4D1C.tmp

                Filesize

                163KB

                MD5

                9441737383d21192400eca82fda910ec

                SHA1

                725e0d606a4fc9ba44aa8ffde65bed15e65367e4

                SHA256

                bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

                SHA512

                7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

              • memory/2220-0-0x0000000001070000-0x0000000001080000-memory.dmp

                Filesize

                64KB

              • memory/2220-1-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

                Filesize

                9.9MB

              • memory/2220-2-0x0000000000FA0000-0x0000000001020000-memory.dmp

                Filesize

                512KB

              • memory/2220-65-0x000007FEF5920000-0x000007FEF630C000-memory.dmp

                Filesize

                9.9MB

              • memory/2220-66-0x0000000000FA0000-0x0000000001020000-memory.dmp

                Filesize

                512KB