Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
17/11/2023, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8e5b64524479e35691da0d13a53fd560.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.8e5b64524479e35691da0d13a53fd560.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.8e5b64524479e35691da0d13a53fd560.exe
-
Size
932KB
-
MD5
8e5b64524479e35691da0d13a53fd560
-
SHA1
9c0ed60022f5a37d6e35e691d1800433d919864e
-
SHA256
b035b8a4f7317697d21a869caddfaced3509483db97e7203109433b55b9cb3b4
-
SHA512
754312b23721d3e01b173e44bcff2d0f5a1eb3c5d4374cb1091f759e31a94dfc4a6eea4fa5d8599be710f255316c34c60ed6d3d047bc60fe1cd689bd83ab34e9
-
SSDEEP
12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSd/Xo0GGjSOpM:P1/aGLDCM4D8ayGMZo8/jXcc2ccDplH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2888 bresy.exe -
Loads dropped DLL 2 IoCs
pid Process 1204 NEAS.8e5b64524479e35691da0d13a53fd560.exe 1204 NEAS.8e5b64524479e35691da0d13a53fd560.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\bresy.exe" bresy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2888 1204 NEAS.8e5b64524479e35691da0d13a53fd560.exe 28 PID 1204 wrote to memory of 2888 1204 NEAS.8e5b64524479e35691da0d13a53fd560.exe 28 PID 1204 wrote to memory of 2888 1204 NEAS.8e5b64524479e35691da0d13a53fd560.exe 28 PID 1204 wrote to memory of 2888 1204 NEAS.8e5b64524479e35691da0d13a53fd560.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8e5b64524479e35691da0d13a53fd560.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8e5b64524479e35691da0d13a53fd560.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\ProgramData\bresy.exe"C:\ProgramData\bresy.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
932KB
MD59f83c119aefb365ed609a7b0c1c2c602
SHA1c3e0da1d998f6a1c97641a0b4f2e25ea2cdde12b
SHA25617803eba55ce752046f4ddc4806ba2b00c682ce58c90e4012c3efc7bcbebb47e
SHA51240db9d745413e8947ee5a2e70b7380acf6d3223703f40d2ae0d5f974673d54669658d0d45c1d5346e44bdc2e0925546d937451bff476609c563291e7e4a94140
-
Filesize
477KB
MD570d6cb7dd01ebd5a21af02945d2ae12f
SHA105260b3e17a221e66b58d1e5ed1d0f518392159a
SHA256136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92
SHA512b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9
-
Filesize
477KB
MD570d6cb7dd01ebd5a21af02945d2ae12f
SHA105260b3e17a221e66b58d1e5ed1d0f518392159a
SHA256136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92
SHA512b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9
-
Filesize
454KB
MD5863e2ddc888c317831fbd8243ce957b7
SHA15e6601223c357d1986b79ef40f52eed8919eaf34
SHA2561aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1
SHA512a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0
-
Filesize
454KB
MD5863e2ddc888c317831fbd8243ce957b7
SHA15e6601223c357d1986b79ef40f52eed8919eaf34
SHA2561aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1
SHA512a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0
-
Filesize
454KB
MD5863e2ddc888c317831fbd8243ce957b7
SHA15e6601223c357d1986b79ef40f52eed8919eaf34
SHA2561aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1
SHA512a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0
-
Filesize
454KB
MD5863e2ddc888c317831fbd8243ce957b7
SHA15e6601223c357d1986b79ef40f52eed8919eaf34
SHA2561aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1
SHA512a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0
-
Filesize
454KB
MD5863e2ddc888c317831fbd8243ce957b7
SHA15e6601223c357d1986b79ef40f52eed8919eaf34
SHA2561aad8507dca44ba3473562c2dd386b1dfee4999bd377edb090b3568569fc50a1
SHA512a5512b807133150fb1250dda8988bf3d2ceb0425a85a66f101ad7b55c93f849104b04789e5531f8f0652ffa43e8118ca42dd08d08321feb90b1fef49eea2cec0