Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2023, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e5539f8a65ba0ba9c076de0408508b90.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.e5539f8a65ba0ba9c076de0408508b90.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.e5539f8a65ba0ba9c076de0408508b90.exe
-
Size
1.6MB
-
MD5
e5539f8a65ba0ba9c076de0408508b90
-
SHA1
43ae33b8afa135ac9329c2580e310b27a80e6b0e
-
SHA256
af24266621f5eead5deff09d4c3470f811256c48d3bf79dc445c11f7346c6bcc
-
SHA512
dd7d3493ba4329fcd49969c845d21333a52dd223a1b13d11be2a32f9cd0863037129c98da32d29d0515f490533cf17e0926a930e3c59720d1007367c673aec84
-
SSDEEP
24576:M51xbcS9in6bxcqbF8fYTOYKbDurSUQN7kBG+JqJS+WOZseId9x0FOXr2rl8:MtbcS4neHbyfYTOYKPu/gEjiEO5ItDz
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fakerdtsc\ImagePath = 5c003f003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c00540065006d0070005c00660061006b006500720064007400730063002e007300790073000000 NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE -
Executes dropped EXE 4 IoCs
pid Process 3016 MSWDM.EXE 868 MSWDM.EXE 712 NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE 408 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" NEAS.e5539f8a65ba0ba9c076de0408508b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" NEAS.e5539f8a65ba0ba9c076de0408508b90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE NEAS.e5539f8a65ba0ba9c076de0408508b90.exe File opened for modification C:\Windows\devB2A1.tmp NEAS.e5539f8a65ba0ba9c076de0408508b90.exe File opened for modification C:\Windows\devB2A1.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 868 MSWDM.EXE 868 MSWDM.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 712 NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 712 NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4256 wrote to memory of 3016 4256 NEAS.e5539f8a65ba0ba9c076de0408508b90.exe 90 PID 4256 wrote to memory of 3016 4256 NEAS.e5539f8a65ba0ba9c076de0408508b90.exe 90 PID 4256 wrote to memory of 3016 4256 NEAS.e5539f8a65ba0ba9c076de0408508b90.exe 90 PID 4256 wrote to memory of 868 4256 NEAS.e5539f8a65ba0ba9c076de0408508b90.exe 92 PID 4256 wrote to memory of 868 4256 NEAS.e5539f8a65ba0ba9c076de0408508b90.exe 92 PID 4256 wrote to memory of 868 4256 NEAS.e5539f8a65ba0ba9c076de0408508b90.exe 92 PID 868 wrote to memory of 712 868 MSWDM.EXE 94 PID 868 wrote to memory of 712 868 MSWDM.EXE 94 PID 868 wrote to memory of 712 868 MSWDM.EXE 94 PID 868 wrote to memory of 408 868 MSWDM.EXE 95 PID 868 wrote to memory of 408 868 MSWDM.EXE 95 PID 868 wrote to memory of 408 868 MSWDM.EXE 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3016
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\devB2A1.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.e5539f8a65ba0ba9c076de0408508b90.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\devB2A1.tmp!C:\Users\Admin\AppData\Local\Temp\NEAS.E5539F8A65BA0BA9C076DE0408508B90.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:408
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51f72b85e7eb9dce9e612a22debf9ffe5
SHA1cd12f9a766c3d194ed5697d1bad2ed8acf036f67
SHA256ef0fe77d614d6c650ae5840593a54bafe2810d60e08c7954e3fbe8ec5bd3f5e3
SHA51275b40356b8d95aa3e7fde9aea78254dba3f18c2f5efcecf5f62cd7429e97091626f282189f73dba2101d8ff1de377cebda65683ed6d4013d3f1e878c7f45dac8
-
Filesize
1.6MB
MD51f72b85e7eb9dce9e612a22debf9ffe5
SHA1cd12f9a766c3d194ed5697d1bad2ed8acf036f67
SHA256ef0fe77d614d6c650ae5840593a54bafe2810d60e08c7954e3fbe8ec5bd3f5e3
SHA51275b40356b8d95aa3e7fde9aea78254dba3f18c2f5efcecf5f62cd7429e97091626f282189f73dba2101d8ff1de377cebda65683ed6d4013d3f1e878c7f45dac8
-
Filesize
11KB
MD59feff3c663336f7a555698bc2bc26f15
SHA12ae180fb131802e91922a153e3c497b807b4cd08
SHA2568c6644f3623291ca88b8a6926093f75b21f3f3dcdb79cbce72205f295267b96c
SHA51239c4f4db4fac609847a6c61f3c66828b9dd8a703043e7d6b7d07f71968c25625fedc84a110e6fed104bef278c585ddd497604452ef13b6d6927cc4bf08c96dbf
-
Filesize
1.6MB
MD503cb0522e126c1438e2282c8a9c5a064
SHA10b4c187d5222613f12787f89a863c82792483920
SHA256d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7
SHA5129537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839
-
Filesize
1.6MB
MD503cb0522e126c1438e2282c8a9c5a064
SHA10b4c187d5222613f12787f89a863c82792483920
SHA256d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7
SHA5129537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839
-
Filesize
1.6MB
MD503cb0522e126c1438e2282c8a9c5a064
SHA10b4c187d5222613f12787f89a863c82792483920
SHA256d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7
SHA5129537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839
-
Filesize
1.6MB
MD503cb0522e126c1438e2282c8a9c5a064
SHA10b4c187d5222613f12787f89a863c82792483920
SHA256d5cedbc44606671f470122459257f55f19170a9506b85fcc2d995f8a8ce786f7
SHA5129537776bbf0bf94218da80332c5f2c3ff27723b1cc0aa40b815a2f4a09c873887e776a85dee8866105d63f7363073536b05368fa945c2f032594593b5a082839
-
Filesize
11KB
MD59feff3c663336f7a555698bc2bc26f15
SHA12ae180fb131802e91922a153e3c497b807b4cd08
SHA2568c6644f3623291ca88b8a6926093f75b21f3f3dcdb79cbce72205f295267b96c
SHA51239c4f4db4fac609847a6c61f3c66828b9dd8a703043e7d6b7d07f71968c25625fedc84a110e6fed104bef278c585ddd497604452ef13b6d6927cc4bf08c96dbf