Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 03:22

General

  • Target

    NEAS.e5539f8a65ba0ba9c076de0408508b90.exe

  • Size

    1.6MB

  • MD5

    e5539f8a65ba0ba9c076de0408508b90

  • SHA1

    43ae33b8afa135ac9329c2580e310b27a80e6b0e

  • SHA256

    af24266621f5eead5deff09d4c3470f811256c48d3bf79dc445c11f7346c6bcc

  • SHA512

    dd7d3493ba4329fcd49969c845d21333a52dd223a1b13d11be2a32f9cd0863037129c98da32d29d0515f490533cf17e0926a930e3c59720d1007367c673aec84

  • SSDEEP

    24576:M51xbcS9in6bxcqbF8fYTOYKbDurSUQN7kBG+JqJS+WOZseId9x0FOXr2rl8:MtbcS4neHbyfYTOYKPu/gEjiEO5ItDz

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3016
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\devB2A1.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe! !
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Users\Admin\AppData\Local\Temp\NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE
        3⤵
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:712
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\devB2A1.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE!
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE

    Filesize

    1.6MB

    MD5

    1f72b85e7eb9dce9e612a22debf9ffe5

    SHA1

    cd12f9a766c3d194ed5697d1bad2ed8acf036f67

    SHA256

    ef0fe77d614d6c650ae5840593a54bafe2810d60e08c7954e3fbe8ec5bd3f5e3

    SHA512

    75b40356b8d95aa3e7fde9aea78254dba3f18c2f5efcecf5f62cd7429e97091626f282189f73dba2101d8ff1de377cebda65683ed6d4013d3f1e878c7f45dac8

  • C:\Users\Admin\AppData\Local\Temp\NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE

    Filesize

    1.6MB

    MD5

    1f72b85e7eb9dce9e612a22debf9ffe5

    SHA1

    cd12f9a766c3d194ed5697d1bad2ed8acf036f67

    SHA256

    ef0fe77d614d6c650ae5840593a54bafe2810d60e08c7954e3fbe8ec5bd3f5e3

    SHA512

    75b40356b8d95aa3e7fde9aea78254dba3f18c2f5efcecf5f62cd7429e97091626f282189f73dba2101d8ff1de377cebda65683ed6d4013d3f1e878c7f45dac8

  • C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe

    Filesize

    11KB

    MD5

    9feff3c663336f7a555698bc2bc26f15

    SHA1

    2ae180fb131802e91922a153e3c497b807b4cd08

    SHA256

    8c6644f3623291ca88b8a6926093f75b21f3f3dcdb79cbce72205f295267b96c

    SHA512

    39c4f4db4fac609847a6c61f3c66828b9dd8a703043e7d6b7d07f71968c25625fedc84a110e6fed104bef278c585ddd497604452ef13b6d6927cc4bf08c96dbf

  • C:\WINDOWS\MSWDM.EXE

    Filesize

    1.6MB

    MD5

    03cb0522e126c1438e2282c8a9c5a064

    SHA1

    0b4c187d5222613f12787f89a863c82792483920

    SHA256

    d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7

    SHA512

    9537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839

  • C:\Windows\MSWDM.EXE

    Filesize

    1.6MB

    MD5

    03cb0522e126c1438e2282c8a9c5a064

    SHA1

    0b4c187d5222613f12787f89a863c82792483920

    SHA256

    d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7

    SHA512

    9537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839

  • C:\Windows\MSWDM.EXE

    Filesize

    1.6MB

    MD5

    03cb0522e126c1438e2282c8a9c5a064

    SHA1

    0b4c187d5222613f12787f89a863c82792483920

    SHA256

    d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7

    SHA512

    9537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839

  • C:\Windows\MSWDM.EXE

    Filesize

    1.6MB

    MD5

    03cb0522e126c1438e2282c8a9c5a064

    SHA1

    0b4c187d5222613f12787f89a863c82792483920

    SHA256

    d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7

    SHA512

    9537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839

  • C:\Windows\devB2A1.tmp

    Filesize

    11KB

    MD5

    9feff3c663336f7a555698bc2bc26f15

    SHA1

    2ae180fb131802e91922a153e3c497b807b4cd08

    SHA256

    8c6644f3623291ca88b8a6926093f75b21f3f3dcdb79cbce72205f295267b96c

    SHA512

    39c4f4db4fac609847a6c61f3c66828b9dd8a703043e7d6b7d07f71968c25625fedc84a110e6fed104bef278c585ddd497604452ef13b6d6927cc4bf08c96dbf

  • memory/408-18-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/712-12-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/712-13-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/868-20-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4256-7-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4256-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB