Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2023, 00:44

General

  • Target

    NEAS.aa3fe0372d4f77990069385f706966d0.exe

  • Size

    288KB

  • MD5

    aa3fe0372d4f77990069385f706966d0

  • SHA1

    88eca00b9c4d88a5f4b89b519944b19aa099fcb0

  • SHA256

    16bef0a8ced602ca78b0eaa8e9246adbdf830fb3a8b3a0c52fc8e4a225eb0f85

  • SHA512

    3971cc3514d48938595112b872857929a515b0aefe1662b152edfd32c9d9a36f2f61661945f43f3fce0cc2468d83c292380e497e2313a0e8c0e545456c9a0e78

  • SSDEEP

    3072:SbsNreBPabLVyAgZeE8arYX35BVYOhXDcl3MSjewQqGffLfmYORoLoY46VroPJzj:RJPV3narYXpBVbhY6SeXlohbVos

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.aa3fe0372d4f77990069385f706966d0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.aa3fe0372d4f77990069385f706966d0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Roaming\server.exe
      C:\Users\Admin\AppData\Roaming\server.exe
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\system32\netsh.exe
        netsh firewall add allowedprogram C:\Users\Admin\AppData\Roaming\server.exe "server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:2060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\server.exe

    Filesize

    288KB

    MD5

    aa3fe0372d4f77990069385f706966d0

    SHA1

    88eca00b9c4d88a5f4b89b519944b19aa099fcb0

    SHA256

    16bef0a8ced602ca78b0eaa8e9246adbdf830fb3a8b3a0c52fc8e4a225eb0f85

    SHA512

    3971cc3514d48938595112b872857929a515b0aefe1662b152edfd32c9d9a36f2f61661945f43f3fce0cc2468d83c292380e497e2313a0e8c0e545456c9a0e78

  • C:\Users\Admin\AppData\Roaming\server.exe

    Filesize

    288KB

    MD5

    aa3fe0372d4f77990069385f706966d0

    SHA1

    88eca00b9c4d88a5f4b89b519944b19aa099fcb0

    SHA256

    16bef0a8ced602ca78b0eaa8e9246adbdf830fb3a8b3a0c52fc8e4a225eb0f85

    SHA512

    3971cc3514d48938595112b872857929a515b0aefe1662b152edfd32c9d9a36f2f61661945f43f3fce0cc2468d83c292380e497e2313a0e8c0e545456c9a0e78

  • \Users\Admin\AppData\Roaming\server.exe

    Filesize

    288KB

    MD5

    aa3fe0372d4f77990069385f706966d0

    SHA1

    88eca00b9c4d88a5f4b89b519944b19aa099fcb0

    SHA256

    16bef0a8ced602ca78b0eaa8e9246adbdf830fb3a8b3a0c52fc8e4a225eb0f85

    SHA512

    3971cc3514d48938595112b872857929a515b0aefe1662b152edfd32c9d9a36f2f61661945f43f3fce0cc2468d83c292380e497e2313a0e8c0e545456c9a0e78