Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
17/11/2023, 02:33
General
-
Target
NEAS.68dc620ba38c4feed9d40902bdb58e20.exe
-
Size
208KB
-
MD5
68dc620ba38c4feed9d40902bdb58e20
-
SHA1
710c5ab2c024fbd85e98e2ae4739d4bfe03fa8bd
-
SHA256
6139873fb7d4f5918a4f2b56dbc49d943c33276d1b453fac2065dfd1cd764601
-
SHA512
c0a7ae0d293cd3f90e8483b09a775b7036e29937134d6ce26cee0870271fb91c4d6c09eeecdbb99652c735d0f8accda83778d8d287c78f197d1297689f8c8526
-
SSDEEP
6144:0ZWia9ubuBsyGvMwlvaB8Mi5vz9IGePA+hq5:iquCuygMQjd5vJIBP1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 22 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.68dc620ba38c4feed9d40902bdb58e20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.68dc620ba38c4feed9d40902bdb58e20.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
208KB
MD59f8cee4a6177334b17b05a0a82d12d98
SHA16e53aab69ac57c1aeed24880cde2f101203ed50f
SHA25698f851306d5805c007fc502e139715ef7d9f91ce1549f48999c53ee0b107db4f
SHA512f2cde6b24846c9625ae523ae04902cdfb9f780553c296ab3fe3d2ba485d8862e8fbb09a131eec8bf9051049b0323f1436fed12a74aaa8f8df5f0d66d9a4c96b9
-
Filesize
208KB
MD59f8cee4a6177334b17b05a0a82d12d98
SHA16e53aab69ac57c1aeed24880cde2f101203ed50f
SHA25698f851306d5805c007fc502e139715ef7d9f91ce1549f48999c53ee0b107db4f
SHA512f2cde6b24846c9625ae523ae04902cdfb9f780553c296ab3fe3d2ba485d8862e8fbb09a131eec8bf9051049b0323f1436fed12a74aaa8f8df5f0d66d9a4c96b9
-
Filesize
208KB
MD59f8cee4a6177334b17b05a0a82d12d98
SHA16e53aab69ac57c1aeed24880cde2f101203ed50f
SHA25698f851306d5805c007fc502e139715ef7d9f91ce1549f48999c53ee0b107db4f
SHA512f2cde6b24846c9625ae523ae04902cdfb9f780553c296ab3fe3d2ba485d8862e8fbb09a131eec8bf9051049b0323f1436fed12a74aaa8f8df5f0d66d9a4c96b9
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
564KB
-
Filesize
328KB
-
Filesize
564KB
-
Filesize
328KB
-
Filesize
564KB