Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe
-
Size
4.0MB
-
MD5
e6b1d9711dbeb1c8a531342da32596d0
-
SHA1
c9e3f577755f367f381618e8f4a7775986fe4fb8
-
SHA256
b6aa2569dcb21b3e19fa1515e9c639493252e2dd9556ae2aa30ad9d5df122e08
-
SHA512
087956b57b40a40e5ac2a652a2042b0c9540089bc1c2f2b138375901f1cb7b1f3985f0b393e678231817b1bde278911dfc20096980555add2dbe79ce6940e623
-
SSDEEP
98304:CdL9xWLs1Esvx3VRy2XOwnqoQyVHXoblgL74+7e:OzwM5S2X9qM3oqLU+7e
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4292 is-Q29AT.tmp 2840 ZxingPDF.exe 500 ZxingPDF.exe -
Loads dropped DLL 1 IoCs
pid Process 4292 is-Q29AT.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 51.159.66.125 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 28 IoCs
description ioc Process File created C:\Program Files (x86)\ZxingPDF\Lang\is-RC9K6.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-JBLD9.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-UQJR7.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Online\is-PH53U.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Help\is-DG0L4.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-PR6F4.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-R91PA.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-7A57V.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-492UK.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Plugins\is-EBJ7L.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-2FDM9.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-5DKRH.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-AOSRI.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-Q8AUI.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Plugins\is-O7NLM.tmp is-Q29AT.tmp File opened for modification C:\Program Files (x86)\ZxingPDF\unins000.dat is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\unins000.dat is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\is-A54Q2.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-GND7D.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-VP5KB.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Plugins\is-A4QPB.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Plugins\is-ULSML.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-NGBF9.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-3FNHP.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Lang\is-R5NHS.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\Online\is-LHO8O.tmp is-Q29AT.tmp File created C:\Program Files (x86)\ZxingPDF\is-1PIBT.tmp is-Q29AT.tmp File opened for modification C:\Program Files (x86)\ZxingPDF\ZxingPDF.exe is-Q29AT.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 3612 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3320 wrote to memory of 4292 3320 NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe 89 PID 3320 wrote to memory of 4292 3320 NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe 89 PID 3320 wrote to memory of 4292 3320 NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe 89 PID 4292 wrote to memory of 1716 4292 is-Q29AT.tmp 91 PID 4292 wrote to memory of 1716 4292 is-Q29AT.tmp 91 PID 4292 wrote to memory of 1716 4292 is-Q29AT.tmp 91 PID 4292 wrote to memory of 2840 4292 is-Q29AT.tmp 92 PID 4292 wrote to memory of 2840 4292 is-Q29AT.tmp 92 PID 4292 wrote to memory of 2840 4292 is-Q29AT.tmp 92 PID 4292 wrote to memory of 500 4292 is-Q29AT.tmp 94 PID 4292 wrote to memory of 500 4292 is-Q29AT.tmp 94 PID 4292 wrote to memory of 500 4292 is-Q29AT.tmp 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\is-DPSH1.tmp\is-Q29AT.tmp"C:\Users\Admin\AppData\Local\Temp\is-DPSH1.tmp\is-Q29AT.tmp" /SL4 $701FE "C:\Users\Admin\AppData\Local\Temp\NEAS.e6b1d9711dbeb1c8a531342da32596d0.exe" 3876134 2421762⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:1716
-
-
C:\Program Files (x86)\ZxingPDF\ZxingPDF.exe"C:\Program Files (x86)\ZxingPDF\ZxingPDF.exe" -i3⤵
- Executes dropped EXE
PID:2840
-
-
C:\Program Files (x86)\ZxingPDF\ZxingPDF.exe"C:\Program Files (x86)\ZxingPDF\ZxingPDF.exe" -s3⤵
- Executes dropped EXE
PID:500
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4796
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5330c3f73c995dbc18c9211269fc579ee
SHA132596c55cfc47c80a8c21dbb28538836cecec40d
SHA256c558e1a93895386068de911f2f92b9e7680b7e3b3649894ccae8f7b12d56849d
SHA51213e095500ad5a57637a7d53ca88deae73921388a0959298fbb8a127f08bec7b108d00405063e6138d1b572b19da9a16ee48564a6ed43880f2a83bdb5428756ca
-
Filesize
2.0MB
MD5330c3f73c995dbc18c9211269fc579ee
SHA132596c55cfc47c80a8c21dbb28538836cecec40d
SHA256c558e1a93895386068de911f2f92b9e7680b7e3b3649894ccae8f7b12d56849d
SHA51213e095500ad5a57637a7d53ca88deae73921388a0959298fbb8a127f08bec7b108d00405063e6138d1b572b19da9a16ee48564a6ed43880f2a83bdb5428756ca
-
Filesize
2.0MB
MD5330c3f73c995dbc18c9211269fc579ee
SHA132596c55cfc47c80a8c21dbb28538836cecec40d
SHA256c558e1a93895386068de911f2f92b9e7680b7e3b3649894ccae8f7b12d56849d
SHA51213e095500ad5a57637a7d53ca88deae73921388a0959298fbb8a127f08bec7b108d00405063e6138d1b572b19da9a16ee48564a6ed43880f2a83bdb5428756ca
-
Filesize
643KB
MD5a991510c12f20ccf8a5231a32a7958c3
SHA1122724d1a4fdea39af3aa427e4941158d7e91dfa
SHA2560c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198
SHA5128f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa
-
Filesize
643KB
MD5a991510c12f20ccf8a5231a32a7958c3
SHA1122724d1a4fdea39af3aa427e4941158d7e91dfa
SHA2560c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198
SHA5128f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63