Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2023, 04:48

General

  • Target

    NEAS.8e5b64524479e35691da0d13a53fd560.exe

  • Size

    932KB

  • MD5

    8e5b64524479e35691da0d13a53fd560

  • SHA1

    9c0ed60022f5a37d6e35e691d1800433d919864e

  • SHA256

    b035b8a4f7317697d21a869caddfaced3509483db97e7203109433b55b9cb3b4

  • SHA512

    754312b23721d3e01b173e44bcff2d0f5a1eb3c5d4374cb1091f759e31a94dfc4a6eea4fa5d8599be710f255316c34c60ed6d3d047bc60fe1cd689bd83ab34e9

  • SSDEEP

    12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSd/Xo0GGjSOpM:P1/aGLDCM4D8ayGMZo8/jXcc2ccDplH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.8e5b64524479e35691da0d13a53fd560.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.8e5b64524479e35691da0d13a53fd560.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\ProgramData\bresy.exe
      "C:\ProgramData\bresy.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    932KB

    MD5

    9f83c119aefb365ed609a7b0c1c2c602

    SHA1

    c3e0da1d998f6a1c97641a0b4f2e25ea2cdde12b

    SHA256

    17803eba55ce752046f4ddc4806ba2b00c682ce58c90e4012c3efc7bcbebb47e

    SHA512

    40db9d745413e8947ee5a2e70b7380acf6d3223703f40d2ae0d5f974673d54669658d0d45c1d5346e44bdc2e0925546d937451bff476609c563291e7e4a94140

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\bresy.exe

    Filesize

    454KB

    MD5

    863e2ddc888c317831fbd8243ce957b7

    SHA1

    5e6601223c357d1986b79ef40f52eed8919eaf34

    SHA256

    1aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1

    SHA512

    a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0

  • C:\ProgramData\bresy.exe

    Filesize

    454KB

    MD5

    863e2ddc888c317831fbd8243ce957b7

    SHA1

    5e6601223c357d1986b79ef40f52eed8919eaf34

    SHA256

    1aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1

    SHA512

    a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0

  • C:\ProgramData\bresy.exe

    Filesize

    454KB

    MD5

    863e2ddc888c317831fbd8243ce957b7

    SHA1

    5e6601223c357d1986b79ef40f52eed8919eaf34

    SHA256

    1aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1

    SHA512

    a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0

  • \ProgramData\bresy.exe

    Filesize

    454KB

    MD5

    863e2ddc888c317831fbd8243ce957b7

    SHA1

    5e6601223c357d1986b79ef40f52eed8919eaf34

    SHA256

    1aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1

    SHA512

    a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0

  • \ProgramData\bresy.exe

    Filesize

    454KB

    MD5

    863e2ddc888c317831fbd8243ce957b7

    SHA1

    5e6601223c357d1986b79ef40f52eed8919eaf34

    SHA256

    1aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1

    SHA512

    a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0

  • memory/1204-12-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2888-102-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB