Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe
-
Size
714KB
-
MD5
5e039bf61627dacd27bd0f2dd48267d0
-
SHA1
8e6ed9c06d6ef5387e8f0a7651a086cb3bf26cfa
-
SHA256
3ecc9228c624d9733273a52c10fe3981fe583cb690351a58944a8c36a829f044
-
SHA512
a5436ebda59faf27ccddf2966ec92588d54a49e5e4e14dcc7bc52b75acc2b23264fd832846364c548aa08998f0b106161223c9390444ac966b1e27a48f17768b
-
SSDEEP
12288:phJ6nTOYREU1gL5pRTcAkS/3hzN8qE43fm78VL:phJ6nTOYKx5jcAkSYqyEL
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2580 MSWDM.EXE 4356 MSWDM.EXE 4724 NEAS.5E039BF61627DACD27BD0F2DD48267D0.EXE 1732 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe File opened for modification C:\Windows\dev16B0.tmp NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe File opened for modification C:\Windows\dev16B0.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4356 MSWDM.EXE 4356 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3784 wrote to memory of 2580 3784 NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe 89 PID 3784 wrote to memory of 2580 3784 NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe 89 PID 3784 wrote to memory of 2580 3784 NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe 89 PID 3784 wrote to memory of 4356 3784 NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe 90 PID 3784 wrote to memory of 4356 3784 NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe 90 PID 3784 wrote to memory of 4356 3784 NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe 90 PID 4356 wrote to memory of 4724 4356 MSWDM.EXE 91 PID 4356 wrote to memory of 4724 4356 MSWDM.EXE 91 PID 4356 wrote to memory of 1732 4356 MSWDM.EXE 94 PID 4356 wrote to memory of 1732 4356 MSWDM.EXE 94 PID 4356 wrote to memory of 1732 4356 MSWDM.EXE 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2580
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev16B0.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.5e039bf61627dacd27bd0f2dd48267d0.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\NEAS.5E039BF61627DACD27BD0F2DD48267D0.EXE
- Executes dropped EXE
PID:4724
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev16B0.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.5E039BF61627DACD27BD0F2DD48267D0.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1732
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714KB
MD594de4ae2a122f3039c48dadfe9c0e9fd
SHA1e1ff1b2fd61d773d1e234f8e326764a21dea7ab0
SHA256088e97b85d5c59065d30a17cbfeae9489694246cff39f74ab947986142d3ac3f
SHA5123eb4074e50185cd57c94ffcb1588e0a7807fc9e71349558fbed4da6eaf954fb0ff8ad59efc66d1b9088597f84500ef8bf6300d358e5c99fbc0c9467535c4bab4
-
Filesize
714KB
MD594de4ae2a122f3039c48dadfe9c0e9fd
SHA1e1ff1b2fd61d773d1e234f8e326764a21dea7ab0
SHA256088e97b85d5c59065d30a17cbfeae9489694246cff39f74ab947986142d3ac3f
SHA5123eb4074e50185cd57c94ffcb1588e0a7807fc9e71349558fbed4da6eaf954fb0ff8ad59efc66d1b9088597f84500ef8bf6300d358e5c99fbc0c9467535c4bab4
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
256KB
MD58a1198209520897514a2d82a912a66d2
SHA15dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA2565ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
SHA5129a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628