Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e6cff92963143c0a40f154daafb450dd.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.e6cff92963143c0a40f154daafb450dd.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e6cff92963143c0a40f154daafb450dd.exe
-
Size
426KB
-
MD5
e6cff92963143c0a40f154daafb450dd
-
SHA1
01699630505ec41243a352389ba1bdece6ceb72d
-
SHA256
08aad1aca4f18420fb1a7afab63f5123bcbb25b83615f36031be54bf46c10207
-
SHA512
2a9d036b43459762d7dfd7024e5b8141f36581a76ea49dfcb97c8bd8a283acccc5c751ccf228357912360c62d53211e965b06f575514fbf392cc9495e3a5fdf9
-
SSDEEP
1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYseB/Y:v1gEZl0nt/P1YPx/oni/Y
Malware Config
Extracted
Protocol: ftp- Host:
ftp.alizametal.com.tr - Port:
21 - Username:
alizametal.com.tr - Password:
hd611
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation NEAS.e6cff92963143c0a40f154daafb450dd.exe -
Executes dropped EXE 1 IoCs
pid Process 2776 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\9013443c\jusched.exe NEAS.e6cff92963143c0a40f154daafb450dd.exe File created C:\Program Files (x86)\9013443c\9013443c NEAS.e6cff92963143c0a40f154daafb450dd.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job NEAS.e6cff92963143c0a40f154daafb450dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2776 1224 NEAS.e6cff92963143c0a40f154daafb450dd.exe 93 PID 1224 wrote to memory of 2776 1224 NEAS.e6cff92963143c0a40f154daafb450dd.exe 93 PID 1224 wrote to memory of 2776 1224 NEAS.e6cff92963143c0a40f154daafb450dd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e6cff92963143c0a40f154daafb450dd.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e6cff92963143c0a40f154daafb450dd.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files (x86)\9013443c\jusched.exe"C:\Program Files (x86)\9013443c\jusched.exe"2⤵
- Executes dropped EXE
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD580e7928b124479791c52c09d831495f6
SHA194c8cb5ce4b1c1e70a2802efc22395c1003fc8bd
SHA256a6bb92ad6bdd253818b2660e9befc8e3689b3bee61233f7a67a6ca0695acab12
SHA5125183e48a8dc4f64277b7a0303f97b704ffa63dcc7256aaddb69994ef108f2f2922d9ec9a62eda403eed6c4f66dd719297c9d24e997f662eded63a49810493d2d
-
Filesize
426KB
MD56730b5b2708183c983b512ffa4c33efb
SHA15cdf21c70c2775b296aabedde1b4fce53a8e09aa
SHA256410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8
SHA512470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821
-
Filesize
426KB
MD56730b5b2708183c983b512ffa4c33efb
SHA15cdf21c70c2775b296aabedde1b4fce53a8e09aa
SHA256410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8
SHA512470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821
-
Filesize
426KB
MD56730b5b2708183c983b512ffa4c33efb
SHA15cdf21c70c2775b296aabedde1b4fce53a8e09aa
SHA256410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8
SHA512470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821