Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe
-
Size
221KB
-
MD5
2f5cc4fbc19b6bc4e5a3005cb093f420
-
SHA1
0d8fa0efa6dedff1bd81f4db82052d13e2682b55
-
SHA256
425cf71ebc627c375cb68f4fbc1791c3fd52cdf68988d15eba945208c986563f
-
SHA512
71508653e9adadd19374410b14935a8e5c9f0ae0af613faa426f86212f5ee23e31b78b05d00668fb073a0f6cbf011916e7a52f88d18c94de00b8386d79350f08
-
SSDEEP
3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/858DpjBFitka5:o68i3odBiTl2+TCU/8gWtkqD
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart" NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\winhash_up.exez NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\bugMAKER.bat NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon10.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon12.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon13.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\winhash_up.exe NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon5.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon14.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon3.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon7.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon6.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\winhash_up.exez NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe File created C:\Windows\SHARE_TEMP\Icon2.ico NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2264 1612 NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe 29 PID 1612 wrote to memory of 2264 1612 NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe 29 PID 1612 wrote to memory of 2264 1612 NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe 29 PID 1612 wrote to memory of 2264 1612 NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2f5cc4fbc19b6bc4e5a3005cb093f420.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\bugMAKER.bat2⤵PID:2264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81B
MD513845dae57fda1e964edef1872a98810
SHA18c1fc3dd3fa2f3fce34876034ce9302adef2e1fa
SHA256587ebce1c5c646e7cf7a88524809aec97d8defe304ff78af7c93fc6be18bb80b
SHA5123771a3b6c13c25e1db09bbe71d1b131e45c431c8fa009805692d4744dd1423e3d78f27f69850e2863b4a62f0a336cd8d80cc38adf3c32bef1bc8e74245b4abe6
-
Filesize
81B
MD513845dae57fda1e964edef1872a98810
SHA18c1fc3dd3fa2f3fce34876034ce9302adef2e1fa
SHA256587ebce1c5c646e7cf7a88524809aec97d8defe304ff78af7c93fc6be18bb80b
SHA5123771a3b6c13c25e1db09bbe71d1b131e45c431c8fa009805692d4744dd1423e3d78f27f69850e2863b4a62f0a336cd8d80cc38adf3c32bef1bc8e74245b4abe6