Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2023, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe
-
Size
1.2MB
-
MD5
5f94cad3f12a82e2d556e4a718ec1710
-
SHA1
a59c8a2b25c47440fdac3546c2a6915d8971a777
-
SHA256
72e3b22c4ca692ba4d32d41e53c26e50902ba271c3a927b7d6066da15be17090
-
SHA512
caf301ea69b4ed7cce34f01bc81307bc86016740ea3c20280f9e8125013e7380c6acfc7a7f4a16885d4de670187bde561643910a853164873c83c1494df59e0e
-
SSDEEP
12288:XQDvmF68BfAgm8ipJdhRjlDa/ZSEniF+G4l:XQ7mk8B/tipJH3a/ZSEniF+9
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4440 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe -
Executes dropped EXE 1 IoCs
pid Process 4440 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 1292 4872 WerFault.exe 84 2708 4440 WerFault.exe 94 3972 4440 WerFault.exe 94 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4872 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4440 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4872 wrote to memory of 4440 4872 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe 94 PID 4872 wrote to memory of 4440 4872 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe 94 PID 4872 wrote to memory of 4440 4872 NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 3442⤵
- Program crash
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5f94cad3f12a82e2d556e4a718ec1710.exeC:\Users\Admin\AppData\Local\Temp\NEAS.5f94cad3f12a82e2d556e4a718ec1710.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 3443⤵
- Program crash
PID:2708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 3443⤵
- Program crash
PID:3972
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4872 -ip 48721⤵PID:3372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4440 -ip 44401⤵PID:4860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4440 -ip 44401⤵PID:4296
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5277451d34b925f44945efad1a363fca8
SHA12028cd8455bc8623128831e21d065e74f8de4e07
SHA256be595912b9948c4d2df04cb69fea28104a7606f2039583307ce7fcf66b2c5bc9
SHA51234073f54a4a64e21bf2dd1b94044b526bb444d2f138ac50220bac3f034336bbd4be1d632f1ddc95f1e9d2182b0822071d5955c70982e44b943c45e62415e7a73