Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2023, 09:07

General

  • Target

    NEAS.498219257e328cea266b54b87d74f3c0.exe

  • Size

    29KB

  • MD5

    498219257e328cea266b54b87d74f3c0

  • SHA1

    09a2ad5f51c6ff974ee9047e6700094848e2bb58

  • SHA256

    3ddee4fb31dffbdd7c18ae48b43cbe1317b6b625672578ba34b8e805da69debe

  • SHA512

    321b88a6aa41bd40aa41ac5a2a527ed9ca5f712e45f22b6eb5f7e78dbb0fbd6480060654a746fcdad847491cbd47e4178d770cee746f56c7b5cf7665fbbc9078

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/vS:AEwVs+0jNDY1qi/qC

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.498219257e328cea266b54b87d74f3c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.498219257e328cea266b54b87d74f3c0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc358a6742ff3194ece4745781f08767

    SHA1

    912d1fa44790e3204da3590c3226812f3639f0f9

    SHA256

    d7e7f54116d3dec26a1bcfe64a998318070d98d2a7bb71062e9e037fe9e9313f

    SHA512

    87694c816188970b89885102ac41074f3cd19a926ac196f36dc06d1a3251e27bfb52053b35ed29d77182fbb63dcfe3c1cf0327cc62d435ed75612e5802244f8b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5f134f8e73a32bb4c2535a25a87bc632

    SHA1

    288abf4ac1ffde81a92157302bfe5e4c29ffb01f

    SHA256

    f8b2db203308e098ed42d0e491e6bf5aa62ef5745b1fbc75cde56afa4d086163

    SHA512

    91109c7aec1e65483b0783d47cb2c6ef48a46897680d6b658e2b9fa549d84b1f9aab0e98c6eb9f8cb462e3d719c0571cda3363060fe650eba86d2fe1e879dfba

  • C:\Users\Admin\AppData\Local\Temp\Cab3163.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar31A4.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Local\Temp\kjFmsfu0.log

    Filesize

    256B

    MD5

    edb25134d549994b2c4abbc54b161e8b

    SHA1

    a7098b5fad8695337faa8ccf15817b011e31a97a

    SHA256

    7b9694e54becc9b66b372670e8826342e2c9ce6418a5ebf4185bd29816aef69f

    SHA512

    6a8852677831e04c46c9dd1c08163a295a743c2bc8ff9031d6b99a7cd5ada9d2238c2eb3050445ec1141f2dcbb51e000336fec88f61516619cc7610f96427b3c

  • C:\Users\Admin\AppData\Local\Temp\tmp2B47.tmp

    Filesize

    29KB

    MD5

    32858cc76b8da4c85e429a96698774e9

    SHA1

    5dea4ccb6a94fbfa6fad0598d6d908a4b0690394

    SHA256

    4bfc9d514ee2f4d6c7cd9ef9b48d58738eec163346d97de11c5b2aae2f803137

    SHA512

    7a9c5ebad5843096f8dda650f76ceaaf0df81179411aa949228d0ed2ed69eb5c80e86912faaec63fe1e2c1bce007b9b9a7ea1678eb635b66d0b77ceda6d73ee4

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    c78922520273acd9f9ec813d93428834

    SHA1

    01b00ddc8bdd044521e185714e782bc51db8a573

    SHA256

    71774442906929e4762cf768b6969d22d8f8ba8c891d81dbfdbbbccbfe7f3cfe

    SHA512

    59f1996c6872378b011fe7e5cc811b5c95f9023d13be36fc89f92016c71bf51a3a9bdeb61a10928d80b6d4063b42eda59fa91b567e40123ecbf9729b767c74f9

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    edee0380d42a4903cd58c652c1c4d54b

    SHA1

    90700d69c05a7a242c485fa23945a222074aeaf6

    SHA256

    a98d7470f47aa31be7b0f1c0a175686e90153bfe87a4b332b1643feaf8da9f48

    SHA512

    fdee52509d79cb2027af785d0653e5f7436b2f5285add077f201b8a0b9092875dacf4307eed7fbea56fc933c7d504e91b1f9ed378831b88db095e1058a4ef84b

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    87ef35b6016b7acdf173fe6a1de9edfa

    SHA1

    982d04bfc058756b62a27b1e887c4ab7b5333e3b

    SHA256

    bc7e97a35085f0707e22b0143f49790a83c54ce9849bfe7612b804501ebb10d6

    SHA512

    f0a7d3478fd2f88bc44c977052c6cb10c7676d909fca36ba5596dd8d1fac864ae267f3d83222e4296d7a06d3534caaf701e52e13ce3128c43f9dedd675b13b77

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    0bdd9e943254df5ed5f3821ac30d5145

    SHA1

    2e142e228e5caff7b1581689547a2c47bf4a8822

    SHA256

    940f705a6c59b42b9a68b0413dc69244f909cc93ecd5380aae82cb5351a40afa

    SHA512

    b4004269cb08b8df2d880c5222883b13d71e394e26265417fb7fc27fca086c977a91e1bcc5bfa90044aee1ca2c0d31773fa0639b8a6e121f8d00b1c98cfe1682

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    c571e8bad43dd7930eda931dc38987c3

    SHA1

    bb14710af5b3ab9c7b7ec6ab6479497a59472828

    SHA256

    8b274fc03a4e389cd432056f3aeac5f54484edd87a7592c6de16ea0a01233974

    SHA512

    406edde77d98424d0ace01069b977cbed8bf0d5cc63e24f5c1e04ecdd7b8f71397522d57cb654e805cc3eec91312122761831f1ab1e7b1cff8952e2f56740e97

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    288B

    MD5

    c78b6c3ab0b3039d9ec5aa52a60b90fc

    SHA1

    7065baf6ed97ddb50a61e01407db9245530bedb5

    SHA256

    9b5dc029630a9b2453de384eccdc237c43878060646880178a4de95c5e2b19fa

    SHA512

    4c8db66901cd7f56cb81aa1070293c8a2c6f6834a9adc73ea27312699c988f0d688b956709ae26fd5262585467b6b21a817c10d4f7c2127d395f8315a4901c75

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2064-321-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-319-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-381-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-23-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-376-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-303-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-51-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-307-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-374-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-309-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-354-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2064-314-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2964-306-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-313-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-320-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-2-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2964-353-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-318-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-373-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-308-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-375-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-302-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2964-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2964-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2964-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB