Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
-
Size
189KB
-
MD5
4df0c17d95dcd3b06d2b6c3125bd5480
-
SHA1
ca01cac80b5b01e41875cd49ed09e65ec759b126
-
SHA256
2d62dd5d5a76d34fe015d8f8c3a368f27e66122c7a5648c01c98e78fd2cec616
-
SHA512
807781313b9862fab50f4999b41237d111cdaaafd272344b3af23557267f4377c322ca3155ee149eae154c3072452624ea87eeeee47d54a5396f19adfa26309d
-
SSDEEP
3072:RYG/aOpxe/FC7MqzID1xt1lDZaGUC19DFjh2JptWhCw3BDR:KnKyC7MBn6sZh4bQ53BDR
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1332 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe -
Executes dropped EXE 1 IoCs
pid Process 1332 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe -
Program crash 5 IoCs
pid pid_target Process procid_target 1340 4872 WerFault.exe 86 2704 1332 WerFault.exe 96 4088 1332 WerFault.exe 96 5064 1332 WerFault.exe 96 3472 1332 WerFault.exe 96 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4872 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1332 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4872 wrote to memory of 1332 4872 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe 96 PID 4872 wrote to memory of 1332 4872 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe 96 PID 4872 wrote to memory of 1332 4872 NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 3842⤵
- Program crash
PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exeC:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 3523⤵
- Program crash
PID:2704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 7683⤵
- Program crash
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 7883⤵
- Program crash
PID:5064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 7723⤵
- Program crash
PID:3472
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4872 -ip 48721⤵PID:3416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1332 -ip 13321⤵PID:3520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1332 -ip 13321⤵PID:2776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1332 -ip 13321⤵PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1332 -ip 13321⤵PID:3840
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD5f11ac4235d514af480919b559ae03b29
SHA1efa3ba3f6ffea38fbafc764ac64ab110b6d4dc21
SHA256115f6aec674b55b379d8f52cd02b56f512ca3f569899a31cbc57a132c7e86a3f
SHA5123094a8e7fb260da84da5c571cad6ea7f8a3f37a909ff10da7e66e6a33cafd7647874a8521fa5d8426461d8591aadef0938611e9f48662cae6e9dd3550f6b2be8