Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 10:20
Behavioral task
behavioral1
Sample
NEAS.afc0e8ca805126afea6a435f63a87820.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.afc0e8ca805126afea6a435f63a87820.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.afc0e8ca805126afea6a435f63a87820.exe
-
Size
210KB
-
MD5
afc0e8ca805126afea6a435f63a87820
-
SHA1
e85b1556917ae98d63ad0d2271caa33c1489c03a
-
SHA256
e52400988a07ce80c2b963cff043e868dcd58b804304e878c882dd398c94a418
-
SHA512
4d4dad888ff21a27c77738d96781b53b220642a6f1dbf54edb5ed6a5855e7a8205c21779a1dcfc9d3d97714bff5b3fa71d236a5f114e6c2d8600ae9e535c8e49
-
SSDEEP
3072:KhS7VD4/EnzzMUD8u8EC45xRS5b7lIf3GYHfqR1hAtTD5DyXglREK0c2:dOizzb8uDxZCHlIZgEh5DyXglh
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0006000000022e0c-10.dat aspack_v212_v242 behavioral2/files/0x0008000000022ded-19.dat aspack_v212_v242 behavioral2/files/0x0008000000022ded-20.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 4756 SKH.EXE -
Modifies system executable filetype association 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\PQCMYR.EXE \"%1\" %*" NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SKH.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PRK.EXE = "C:\\Users\\EOIGQQ.EXE" NEAS.afc0e8ca805126afea6a435f63a87820.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\V: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\N: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\S: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\R: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\E: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\K: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\I: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\J: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\M: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\O: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\G: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\H: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\Q: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\T: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\L: NEAS.afc0e8ca805126afea6a435f63a87820.exe File opened (read-only) \??\P: NEAS.afc0e8ca805126afea6a435f63a87820.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Users\\XBXDWN.EXE \"%1\"" NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\PerfLogs\\ENBN.EXE %1" NEAS.afc0e8ca805126afea6a435f63a87820.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\XBXDWN.EXE %1" NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command NEAS.afc0e8ca805126afea6a435f63a87820.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\PQCMYR.EXE \"%1\" %*" NEAS.afc0e8ca805126afea6a435f63a87820.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SKH.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Users\\XBXDWN.EXE \"%1\"" NEAS.afc0e8ca805126afea6a435f63a87820.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4756 SKH.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1616 wrote to memory of 4756 1616 NEAS.afc0e8ca805126afea6a435f63a87820.exe 87 PID 1616 wrote to memory of 4756 1616 NEAS.afc0e8ca805126afea6a435f63a87820.exe 87 PID 1616 wrote to memory of 4756 1616 NEAS.afc0e8ca805126afea6a435f63a87820.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.afc0e8ca805126afea6a435f63a87820.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.afc0e8ca805126afea6a435f63a87820.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\odt\SKH.EXEC:\odt\SKH.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4756
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD56de114fe5a09b83ecf392a83d25d350a
SHA1937cb6f9bd32afa0921ef8badca9e5baa0ef9989
SHA256f5de191d7c6dec75f626dd07d6f985223225f2efb3f705922a2c63c6402c1f16
SHA512af1e87c4489d79f2f0716e65ce62f9c9eccff8177f78dbe5be839174db9b4edf0e4d9094ded41e6902db66827ed281f439a7e75572e63eaa55b2f081f3ce94d2
-
Filesize
211KB
MD53994411261b7b090d3d44faa01117c99
SHA1f8a23a98ef0c809eb449f2d0d30963336402bdee
SHA256d7599f6b93c81965a04c435f4c6879fc117feae514145fe8df25f67335340e1c
SHA512981c8b097c9a0374fa16fe26ce80ad1a40a3ebe5c293c906959b38a5e206ea09330702fdbad7ce6af9f295023a20e9a24d01cde140b487b85e39d0554568c37c
-
Filesize
211KB
MD53994411261b7b090d3d44faa01117c99
SHA1f8a23a98ef0c809eb449f2d0d30963336402bdee
SHA256d7599f6b93c81965a04c435f4c6879fc117feae514145fe8df25f67335340e1c
SHA512981c8b097c9a0374fa16fe26ce80ad1a40a3ebe5c293c906959b38a5e206ea09330702fdbad7ce6af9f295023a20e9a24d01cde140b487b85e39d0554568c37c