Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 05:52
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe
Resource
win7-20231025-en
General
-
Target
NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe
-
Size
693KB
-
MD5
8e7b009c96a5cd56c3d5d58b3668a9b0
-
SHA1
4d6b6c3985bd188aea69ae2199c9ec3a98dbbdf7
-
SHA256
68c9f16734869c705f482e59781712b2c2fb3d201d188abfed06328aebb3550b
-
SHA512
b9dc8166fec44e25d2428780d46e491d0e0d45d0b78dfb19df3772bee56aac233372ffaa338b14cc56da6e47631454e7672b755fa161312771795ee4b1381018
-
SSDEEP
12288:zJB0lh5aILwtFPCfmAUt3r4DwpRrKO1YYVhiiyvcN:zQ5aILMCfmAUhrSO1YNVg
Malware Config
Signatures
-
Trickbot x86 loader 9 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral2/memory/5020-17-0x0000000002B90000-0x0000000002BB9000-memory.dmp trickbot_loader32 behavioral2/memory/5020-19-0x0000000002B90000-0x0000000002BB9000-memory.dmp trickbot_loader32 behavioral2/memory/5020-43-0x0000000002B90000-0x0000000002BB9000-memory.dmp trickbot_loader32 behavioral2/memory/3160-44-0x0000000002310000-0x0000000002339000-memory.dmp trickbot_loader32 behavioral2/memory/3160-59-0x0000000002310000-0x0000000002339000-memory.dmp trickbot_loader32 behavioral2/memory/2424-80-0x0000000000DC0000-0x0000000000DE9000-memory.dmp trickbot_loader32 behavioral2/memory/2424-94-0x0000000000DC0000-0x0000000000DE9000-memory.dmp trickbot_loader32 behavioral2/memory/3984-117-0x0000000000CC0000-0x0000000000CE9000-memory.dmp trickbot_loader32 behavioral2/memory/3984-131-0x0000000000CC0000-0x0000000000CE9000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTcbPrivilege 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe Token: SeTcbPrivilege 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5020 NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 3160 5020 NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 92 PID 5020 wrote to memory of 3160 5020 NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 92 PID 5020 wrote to memory of 3160 5020 NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 92 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 3160 wrote to memory of 4264 3160 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 93 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 2424 wrote to memory of 4088 2424 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 111 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 PID 3984 wrote to memory of 4564 3984 NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exeC:\Users\Admin\AppData\Roaming\WinSocket\NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4264
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exeC:\Users\Admin\AppData\Roaming\WinSocket\NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4088
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exeC:\Users\Admin\AppData\Roaming\WinSocket\NFAS.8e7b009c96a5cd56c3d5d58b3668a9b0.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
693KB
MD58e7b009c96a5cd56c3d5d58b3668a9b0
SHA14d6b6c3985bd188aea69ae2199c9ec3a98dbbdf7
SHA25668c9f16734869c705f482e59781712b2c2fb3d201d188abfed06328aebb3550b
SHA512b9dc8166fec44e25d2428780d46e491d0e0d45d0b78dfb19df3772bee56aac233372ffaa338b14cc56da6e47631454e7672b755fa161312771795ee4b1381018
-
Filesize
693KB
MD58e7b009c96a5cd56c3d5d58b3668a9b0
SHA14d6b6c3985bd188aea69ae2199c9ec3a98dbbdf7
SHA25668c9f16734869c705f482e59781712b2c2fb3d201d188abfed06328aebb3550b
SHA512b9dc8166fec44e25d2428780d46e491d0e0d45d0b78dfb19df3772bee56aac233372ffaa338b14cc56da6e47631454e7672b755fa161312771795ee4b1381018
-
Filesize
693KB
MD58e7b009c96a5cd56c3d5d58b3668a9b0
SHA14d6b6c3985bd188aea69ae2199c9ec3a98dbbdf7
SHA25668c9f16734869c705f482e59781712b2c2fb3d201d188abfed06328aebb3550b
SHA512b9dc8166fec44e25d2428780d46e491d0e0d45d0b78dfb19df3772bee56aac233372ffaa338b14cc56da6e47631454e7672b755fa161312771795ee4b1381018
-
Filesize
693KB
MD58e7b009c96a5cd56c3d5d58b3668a9b0
SHA14d6b6c3985bd188aea69ae2199c9ec3a98dbbdf7
SHA25668c9f16734869c705f482e59781712b2c2fb3d201d188abfed06328aebb3550b
SHA512b9dc8166fec44e25d2428780d46e491d0e0d45d0b78dfb19df3772bee56aac233372ffaa338b14cc56da6e47631454e7672b755fa161312771795ee4b1381018
-
Filesize
68KB
MD5e6e2e4af7ff903eaffde42e7e6312a15
SHA12096300f5bedd66a8ba8568a618972feb1f8089c
SHA256e89d338212ce44afc415fe60cf96aa6a406c4ac8cf62d25e94f898eaceeaa8f4
SHA512eb3ecba9a32563b7d1977688aa9b32b82cc28790f4a260f590d699ca17ed4fac71c829c8edca46430b17ffa1501e7b8c6bfc653a5995c6cf6b3cf66ecacfda56