Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2023, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c9165c79706fdcfaaa98fee95d4bc5a0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c9165c79706fdcfaaa98fee95d4bc5a0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c9165c79706fdcfaaa98fee95d4bc5a0.exe
-
Size
347KB
-
MD5
c9165c79706fdcfaaa98fee95d4bc5a0
-
SHA1
a5dc9b0d8454093987f9a0f95635ee36cf159a8e
-
SHA256
e7aa05286c7456f59cd8b22d797a4555716b1d0a4c3dd1f274b504bdff7124d9
-
SHA512
573df0e19f7594dfac254c982c778bfc5f4a1c8bc12b9a82ed6d81d0d96936e44500f38b7d91f5592eb1ce1c1976966031b062e0a45d7fe2266f9956aab632b7
-
SSDEEP
6144:9/5ybPL6fUZLEZZXgsO/5ybPG3xzu02/5ybPL2:qbPyREsxbPOxzrbPS
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 3872 axfniqh.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\axfniqh.exe NEAS.c9165c79706fdcfaaa98fee95d4bc5a0.exe File created C:\PROGRA~3\Mozilla\bqqaoam.dll axfniqh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c9165c79706fdcfaaa98fee95d4bc5a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c9165c79706fdcfaaa98fee95d4bc5a0.exe"1⤵
- Drops file in Program Files directory
PID:2092
-
C:\PROGRA~3\Mozilla\axfniqh.exeC:\PROGRA~3\Mozilla\axfniqh.exe -pdtylqd1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
347KB
MD5072d035339f88429af83574aec10e1b0
SHA1747062ed46c53ba26be2bde5da53568e024cecdb
SHA25685f814a33314fd0586276048f0e7aaaee481367278038d57913357b2f2082529
SHA5125a590f1544b6060295e97473ed5fa2a0a58108a128af83e5d54dc80d8dbcc2f15961f6485c1bd394b39ef6e075769075745d0972e57fff739c2f8cf0c2da860a
-
Filesize
347KB
MD5072d035339f88429af83574aec10e1b0
SHA1747062ed46c53ba26be2bde5da53568e024cecdb
SHA25685f814a33314fd0586276048f0e7aaaee481367278038d57913357b2f2082529
SHA5125a590f1544b6060295e97473ed5fa2a0a58108a128af83e5d54dc80d8dbcc2f15961f6485c1bd394b39ef6e075769075745d0972e57fff739c2f8cf0c2da860a