Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
12/11/2023, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2247ac49d4cb25a062182061eddaa26c.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.2247ac49d4cb25a062182061eddaa26c.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.2247ac49d4cb25a062182061eddaa26c.exe
-
Size
2.8MB
-
MD5
2247ac49d4cb25a062182061eddaa26c
-
SHA1
bb94fb7c79620b93e2d8ec18232b48a6c6863188
-
SHA256
f18e47a912b2b62771bc2b2bcbbe1bf3b3446dc6a26cf8182caf109b310dae52
-
SHA512
f7930c3c82a7d223264623d86442f5ba9c895b1a71debeec1c60695db16972cbc06cff926992cf5fb9ae1973d12fe2a5e85404934a333e2c2e26e618a8137232
-
SSDEEP
3072:vxS78Eu6RzLxK7IMsv38AuxfEGz5tEAX0eP2yCuvPIopzqt2onDPMS0veJu:vY9LxK/Y3kxfBz5t9XJJ53z3TLwu
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2928 NEAS.2247ac49d4cb25a062182061eddaa26c.exe 2928 NEAS.2247ac49d4cb25a062182061eddaa26c.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2936 2928 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2936 2928 NEAS.2247ac49d4cb25a062182061eddaa26c.exe 28 PID 2928 wrote to memory of 2936 2928 NEAS.2247ac49d4cb25a062182061eddaa26c.exe 28 PID 2928 wrote to memory of 2936 2928 NEAS.2247ac49d4cb25a062182061eddaa26c.exe 28 PID 2928 wrote to memory of 2936 2928 NEAS.2247ac49d4cb25a062182061eddaa26c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2247ac49d4cb25a062182061eddaa26c.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2247ac49d4cb25a062182061eddaa26c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 2002⤵
- Program crash
PID:2936
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD582f06ec2a6a2c3e42c951b749a28c43f
SHA17b08ea2f252d75e9476fd778e10b97311cd3fef3
SHA256523c4336f300599f63def8274c82d88c946ef78940e675b07eb6c1fb6f4ca5e5
SHA5124d10b0f0b943c6e9562d3f5d4a2557814a881e54f19cac0f9ae9ecdf2a3fb9775b30095e195a85bc9361698e4dd349b4a223d1cb141c4f4f3587fbcf9f17d8ae
-
Filesize
3.0MB
MD582f06ec2a6a2c3e42c951b749a28c43f
SHA17b08ea2f252d75e9476fd778e10b97311cd3fef3
SHA256523c4336f300599f63def8274c82d88c946ef78940e675b07eb6c1fb6f4ca5e5
SHA5124d10b0f0b943c6e9562d3f5d4a2557814a881e54f19cac0f9ae9ecdf2a3fb9775b30095e195a85bc9361698e4dd349b4a223d1cb141c4f4f3587fbcf9f17d8ae