Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 22:38

General

  • Target

    NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

  • Size

    189KB

  • MD5

    4df0c17d95dcd3b06d2b6c3125bd5480

  • SHA1

    ca01cac80b5b01e41875cd49ed09e65ec759b126

  • SHA256

    2d62dd5d5a76d34fe015d8f8c3a368f27e66122c7a5648c01c98e78fd2cec616

  • SHA512

    807781313b9862fab50f4999b41237d111cdaaafd272344b3af23557267f4377c322ca3155ee149eae154c3072452624ea87eeeee47d54a5396f19adfa26309d

  • SSDEEP

    3072:RYG/aOpxe/FC7MqzID1xt1lDZaGUC19DFjh2JptWhCw3BDR:KnKyC7MBn6sZh4bQ53BDR

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 384
      2⤵
      • Program crash
      PID:1340
    • C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
      C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 352
        3⤵
        • Program crash
        PID:2704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 768
        3⤵
        • Program crash
        PID:4088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 788
        3⤵
        • Program crash
        PID:5064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 772
        3⤵
        • Program crash
        PID:3472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4872 -ip 4872
    1⤵
      PID:3416
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1332 -ip 1332
      1⤵
        PID:3520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1332 -ip 1332
        1⤵
          PID:2776
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1332 -ip 1332
          1⤵
            PID:4040
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1332 -ip 1332
            1⤵
              PID:3840

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

              Filesize

              189KB

              MD5

              f11ac4235d514af480919b559ae03b29

              SHA1

              efa3ba3f6ffea38fbafc764ac64ab110b6d4dc21

              SHA256

              115f6aec674b55b379d8f52cd02b56f512ca3f569899a31cbc57a132c7e86a3f

              SHA512

              3094a8e7fb260da84da5c571cad6ea7f8a3f37a909ff10da7e66e6a33cafd7647874a8521fa5d8426461d8591aadef0938611e9f48662cae6e9dd3550f6b2be8

            • memory/1332-7-0x0000000000400000-0x000000000043C000-memory.dmp

              Filesize

              240KB

            • memory/1332-8-0x00000000014D0000-0x000000000150C000-memory.dmp

              Filesize

              240KB

            • memory/1332-9-0x0000000000400000-0x0000000000415000-memory.dmp

              Filesize

              84KB

            • memory/4872-0-0x0000000000400000-0x000000000043C000-memory.dmp

              Filesize

              240KB

            • memory/4872-6-0x0000000000400000-0x000000000043C000-memory.dmp

              Filesize

              240KB