Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.43356128735747b472d98211f980d57a.exe
Resource
win7-20231020-en
General
-
Target
NEAS.43356128735747b472d98211f980d57a.exe
-
Size
124KB
-
MD5
43356128735747b472d98211f980d57a
-
SHA1
ead1956ef510f9ecd8d388b03a518af6de776a5f
-
SHA256
831a3e29e0a1e5f06c60d956c5cac3d32dfb86d82c5ffa8cf1240e960c64855a
-
SHA512
7905d04d93c6f57a8fd2f570bb4a8bad26627f98c6330d7e038f2309d00a90a795da9acb57a0db06281ec8273cf7e6eb9d4a8d0b67afc7f24e630132085dcb15
-
SSDEEP
1536:3C+ltNKIxyDjxxNA6vOOZsBLD/qMJEAhHmRYHE7mqfm0yn:3C+ltUIs9pO9/jj8YKmF
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.207
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation NEAS.43356128735747b472d98211f980d57a.exe -
Executes dropped EXE 1 IoCs
pid Process 4284 huter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1492 wrote to memory of 4284 1492 NEAS.43356128735747b472d98211f980d57a.exe 91 PID 1492 wrote to memory of 4284 1492 NEAS.43356128735747b472d98211f980d57a.exe 91 PID 1492 wrote to memory of 4284 1492 NEAS.43356128735747b472d98211f980d57a.exe 91 PID 1492 wrote to memory of 3372 1492 NEAS.43356128735747b472d98211f980d57a.exe 92 PID 1492 wrote to memory of 3372 1492 NEAS.43356128735747b472d98211f980d57a.exe 92 PID 1492 wrote to memory of 3372 1492 NEAS.43356128735747b472d98211f980d57a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.43356128735747b472d98211f980d57a.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.43356128735747b472d98211f980d57a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:4284
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:3372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD56c7b9d5d0c8c895b27e9c92196ff145c
SHA15df3e0a05d84df13876a50c8607f6f86bf588380
SHA2561246443d1394e56a60994bcc80a29239ffa86467f5fcfb4a962a50736b865dce
SHA51264899b68c5812765762d076699fc007df0c4397a24999c3ad8cb3d7556737696b383b039c89b41099ee63249e7d76acbcf1fd84311de5abc98008b05fd176424
-
Filesize
124KB
MD521725f6c5b54da2bc9872e6f4862b01b
SHA16ebe211b64a34d49f1625f37f8a396f86cae7753
SHA25679a6d1f59eb0a1dea659853de86c7d8be89690854c5cae03736c5e0cf8b9a163
SHA512770cddf1c24c93da1041736be2b47074f24b48325c032394c253805cc875361697fa4240e9e2d276a30f76d694b7681860ab4408dcf12bd3fa28f83ee413e7e6
-
Filesize
124KB
MD521725f6c5b54da2bc9872e6f4862b01b
SHA16ebe211b64a34d49f1625f37f8a396f86cae7753
SHA25679a6d1f59eb0a1dea659853de86c7d8be89690854c5cae03736c5e0cf8b9a163
SHA512770cddf1c24c93da1041736be2b47074f24b48325c032394c253805cc875361697fa4240e9e2d276a30f76d694b7681860ab4408dcf12bd3fa28f83ee413e7e6
-
Filesize
124KB
MD521725f6c5b54da2bc9872e6f4862b01b
SHA16ebe211b64a34d49f1625f37f8a396f86cae7753
SHA25679a6d1f59eb0a1dea659853de86c7d8be89690854c5cae03736c5e0cf8b9a163
SHA512770cddf1c24c93da1041736be2b47074f24b48325c032394c253805cc875361697fa4240e9e2d276a30f76d694b7681860ab4408dcf12bd3fa28f83ee413e7e6
-
Filesize
284B
MD57255ac5fa85797ccdcec4bc0d5b0dec4
SHA1666bc56ce3f59b114f1d3d6882c01d4ac834c70b
SHA256b27c3c2db394427dd61cfaa0e22e906e62f03f37366a2c792c5e3d5b4b217c02
SHA512ab45a9833c2b36d8479c62e6d72c3185020378db475bfc51852bddea9855b9381980d2be5cdec8ae524689efbeabc3e2ceb5ace792df4010bd7c08145d7baefd