Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 16:46

General

  • Target

    NEAS.e6cff92963143c0a40f154daafb450dd.exe

  • Size

    426KB

  • MD5

    e6cff92963143c0a40f154daafb450dd

  • SHA1

    01699630505ec41243a352389ba1bdece6ceb72d

  • SHA256

    08aad1aca4f18420fb1a7afab63f5123bcbb25b83615f36031be54bf46c10207

  • SHA512

    2a9d036b43459762d7dfd7024e5b8141f36581a76ea49dfcb97c8bd8a283acccc5c751ccf228357912360c62d53211e965b06f575514fbf392cc9495e3a5fdf9

  • SSDEEP

    1536:vZ/fgEAqJlV+n1EgGHo7P1YPx28VayonYseB/Y:v1gEZl0nt/P1YPx/oni/Y

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.alizametal.com.tr
  • Port:
    21
  • Username:
    alizametal.com.tr
  • Password:
    hd611

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.e6cff92963143c0a40f154daafb450dd.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.e6cff92963143c0a40f154daafb450dd.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Program Files (x86)\9013443c\jusched.exe
      "C:\Program Files (x86)\9013443c\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\9013443c\9013443c

    Filesize

    17B

    MD5

    80e7928b124479791c52c09d831495f6

    SHA1

    94c8cb5ce4b1c1e70a2802efc22395c1003fc8bd

    SHA256

    a6bb92ad6bdd253818b2660e9befc8e3689b3bee61233f7a67a6ca0695acab12

    SHA512

    5183e48a8dc4f64277b7a0303f97b704ffa63dcc7256aaddb69994ef108f2f2922d9ec9a62eda403eed6c4f66dd719297c9d24e997f662eded63a49810493d2d

  • C:\Program Files (x86)\9013443c\jusched.exe

    Filesize

    426KB

    MD5

    6730b5b2708183c983b512ffa4c33efb

    SHA1

    5cdf21c70c2775b296aabedde1b4fce53a8e09aa

    SHA256

    410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8

    SHA512

    470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821

  • C:\Program Files (x86)\9013443c\jusched.exe

    Filesize

    426KB

    MD5

    6730b5b2708183c983b512ffa4c33efb

    SHA1

    5cdf21c70c2775b296aabedde1b4fce53a8e09aa

    SHA256

    410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8

    SHA512

    470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821

  • C:\Program Files (x86)\9013443c\jusched.exe

    Filesize

    426KB

    MD5

    6730b5b2708183c983b512ffa4c33efb

    SHA1

    5cdf21c70c2775b296aabedde1b4fce53a8e09aa

    SHA256

    410188c62dd88cd62bf4aae52f030a0381a7c09e5652f3100c879316f54d9fa8

    SHA512

    470445d1c761dce9bfebfef6251d8aadfa3231b9ef944e85c5ecdd495d4963ba35302427401ad6a1306329fb672521eabff37135c8bc0c5e544a74b73c7eb821

  • memory/1224-0-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2776-14-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB