Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ee8da0e12ce3307014c29fce929b2790.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.ee8da0e12ce3307014c29fce929b2790.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.ee8da0e12ce3307014c29fce929b2790.exe
-
Size
3.0MB
-
MD5
ee8da0e12ce3307014c29fce929b2790
-
SHA1
b609a66d316c942fdeaba58dcfffb9cc9c68cd0b
-
SHA256
be5f9cbb736cf7a907ad7ecb5fd0c4c1b1662dade2ef802d5266626fa72cbcae
-
SHA512
773581cedf71c663daae9dd86b7d2e307619fd7f790bfc82155e3bbfb0dee96510b7311e20caea84718879e0026cba04f625616a6b6f7ea52d13e206e5db9a4e
-
SSDEEP
49152:C5tMAdyKy8aT2d7xpWZ6tmDANl3+s5oGzjdTD0xc2cAx1BYq8vLmrDdGPj/5PtKZ:EdH77y6tMe55p0xc2Hx1F+Lmt+j/5Pts
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4604 NEAS.ee8da0e12ce3307014c29fce929b2790.tmp -
Loads dropped DLL 1 IoCs
pid Process 4604 NEAS.ee8da0e12ce3307014c29fce929b2790.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2824 wrote to memory of 4604 2824 NEAS.ee8da0e12ce3307014c29fce929b2790.exe 86 PID 2824 wrote to memory of 4604 2824 NEAS.ee8da0e12ce3307014c29fce929b2790.exe 86 PID 2824 wrote to memory of 4604 2824 NEAS.ee8da0e12ce3307014c29fce929b2790.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ee8da0e12ce3307014c29fce929b2790.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ee8da0e12ce3307014c29fce929b2790.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\is-TRMII.tmp\NEAS.ee8da0e12ce3307014c29fce929b2790.tmp"C:\Users\Admin\AppData\Local\Temp\is-TRMII.tmp\NEAS.ee8da0e12ce3307014c29fce929b2790.tmp" /SL5="$B020E,2695982,119296,C:\Users\Admin\AppData\Local\Temp\NEAS.ee8da0e12ce3307014c29fce929b2790.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4604
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
Filesize
1.1MB
MD5129b8e200a6e90e813080c9ce0474063
SHA1b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA256cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
SHA51210949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841