Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
18/11/2023, 04:37
General
-
Target
NEAS.93563d69322b21f0532e3007c6f523c0.exe
-
Size
4.2MB
-
MD5
93563d69322b21f0532e3007c6f523c0
-
SHA1
0929dc0962031fe893235c03f70ea020c6cd56ab
-
SHA256
b719917f7913fb88bc684b02f7a1c4e3dc7c40e08a2b1a4ef15a448500ad3a18
-
SHA512
d8802c68a94d381ceabf3df72f32de47bbc19f6cd73c95a974be378c270cd37024054edb21bcf86fb0d24b56ce3da0d9af62fd91130e289e17e471cf84f3bda8
-
SSDEEP
98304:oXB4uluJRmMg6QWlIpgi0rHqsih/mCqJ4B4uluB:ovsJR0TW6yiIKRhzqOsB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.93563d69322b21f0532e3007c6f523c0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.93563d69322b21f0532e3007c6f523c0.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\O2UZM.exe"C:\Users\Admin\AppData\Local\Temp\O2UZM.exe" -Continue|"C:\Users\Admin\AppData\Local\Temp\NEAS.93563d69322b21f0532e3007c6f523c0.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD55a8e8dedf1d910c79defff5638978d07
SHA1bfab518af8a53f02c4f98fc321aa0984a208686c
SHA256d5bf8619a6f47e74aceb629da039f25493b0b8fb2f892bda2b32bd68c0cf8893
SHA5127acfc4d0bde75a518f394319c8cd6743d36eb7ebcdcd26eeae2fb59ead70bb8b4d2fb29be93c89b529775f8a407a9bcd6e4d2a2955c03b15f2880ff9aa61a519
-
Filesize
4.2MB
MD59144696ef705e37e79e977feb4d86e65
SHA1ab3163996d39af80395ed5553f898e97378b8c52
SHA2565925e95b0c97ba884b096fa9b966050b994e0779072229fc3984d13a82c848b4
SHA512de580344ba9717efa86251348352d2cf6d5d17bcda8f433e429b96d6bbe647eeb35ade47fc61c309cba9f778fd598bc9cb8b398e2f113fd9e23595904317151b
-
Filesize
4.2MB
MD59144696ef705e37e79e977feb4d86e65
SHA1ab3163996d39af80395ed5553f898e97378b8c52
SHA2565925e95b0c97ba884b096fa9b966050b994e0779072229fc3984d13a82c848b4
SHA512de580344ba9717efa86251348352d2cf6d5d17bcda8f433e429b96d6bbe647eeb35ade47fc61c309cba9f778fd598bc9cb8b398e2f113fd9e23595904317151b
-
Filesize
1.3MB
MD5a70486cf41bf065ff8e76e8619745361
SHA1e06e75380b17fec737fbdfeaa4a09b83e54d4838
SHA2561563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858
SHA51202f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0
-
Filesize
1.3MB
MD5a70486cf41bf065ff8e76e8619745361
SHA1e06e75380b17fec737fbdfeaa4a09b83e54d4838
SHA2561563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858
SHA51202f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0
-
Filesize
1.3MB
MD5a70486cf41bf065ff8e76e8619745361
SHA1e06e75380b17fec737fbdfeaa4a09b83e54d4838
SHA2561563fc1966e779f0fcb71753f15e73ec770e169a0ad6e3c5af736764d9bd5858
SHA51202f1c909fcbf7c0f5604ccb4e807640d80a2236c3cac6975e2e849bda318419e7188bb6a48184940eb381e2af375c83d7539e58951edf5e49ec11dd0cff66cc0
-
Filesize
9.9MB
-
Filesize
896KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
1.3MB
-
Filesize
264KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
4.2MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
264KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
4.2MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB