Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.28d5db283e5833f98e2aea4badcf2490.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.28d5db283e5833f98e2aea4badcf2490.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.28d5db283e5833f98e2aea4badcf2490.exe
-
Size
38KB
-
MD5
28d5db283e5833f98e2aea4badcf2490
-
SHA1
0ce13c2b6c4c6b6988ff7d486523fece6e9d811d
-
SHA256
30c7091c6dff76a77eed0c53d6fc7464b763020eb9892e85fe6819e65f1c03e0
-
SHA512
401b9e28dcaf9f6dac5ab2d43e7519fa366b5de22ba25e79d6f8fad76428933c8c7286e583f3dc3c47342f0b4f787887c641bf7f35646bf80daa46282d41975a
-
SSDEEP
768:agwpLIesy68Q3+dotaqCKLeDNajYpxS632z3Ck7Z5NF8:OpFsCdKfCKLjYpxWr7Na
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation NEAS.28d5db283e5833f98e2aea4badcf2490.exe -
Executes dropped EXE 1 IoCs
pid Process 5088 ygczw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3804 wrote to memory of 5088 3804 NEAS.28d5db283e5833f98e2aea4badcf2490.exe 92 PID 3804 wrote to memory of 5088 3804 NEAS.28d5db283e5833f98e2aea4badcf2490.exe 92 PID 3804 wrote to memory of 5088 3804 NEAS.28d5db283e5833f98e2aea4badcf2490.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.28d5db283e5833f98e2aea4badcf2490.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.28d5db283e5833f98e2aea4badcf2490.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\ygczw.exe"C:\Users\Admin\AppData\Local\Temp\ygczw.exe"2⤵
- Executes dropped EXE
PID:5088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD558478ed57da24c2af069718ce93c6d82
SHA1ddfac3f8e141df5b06a6b4f8b76e1a112d2e5ea4
SHA2565073a3abc0ccea5f2f40b569b7c9715c87dbe04f7021a3ad875f44111d713dda
SHA512ac81d02fe2d69c8c4868b87ecf0031ac4d8a1f80a1a90dede308513a1ed43484150f5a9203665f46a10db831c2cdaf2d5d7ac4f32db9c7628416bb07e3c8e339
-
Filesize
38KB
MD558478ed57da24c2af069718ce93c6d82
SHA1ddfac3f8e141df5b06a6b4f8b76e1a112d2e5ea4
SHA2565073a3abc0ccea5f2f40b569b7c9715c87dbe04f7021a3ad875f44111d713dda
SHA512ac81d02fe2d69c8c4868b87ecf0031ac4d8a1f80a1a90dede308513a1ed43484150f5a9203665f46a10db831c2cdaf2d5d7ac4f32db9c7628416bb07e3c8e339
-
Filesize
38KB
MD558478ed57da24c2af069718ce93c6d82
SHA1ddfac3f8e141df5b06a6b4f8b76e1a112d2e5ea4
SHA2565073a3abc0ccea5f2f40b569b7c9715c87dbe04f7021a3ad875f44111d713dda
SHA512ac81d02fe2d69c8c4868b87ecf0031ac4d8a1f80a1a90dede308513a1ed43484150f5a9203665f46a10db831c2cdaf2d5d7ac4f32db9c7628416bb07e3c8e339