Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe
-
Size
92KB
-
MD5
4ecf77b051b69dc4a9a4c385753891a0
-
SHA1
8c146c00f0da525d9cf9f901d8312409ab68ebae
-
SHA256
a70a91d8604e923a109306bd0befae050e01e711d18aadfea4e46e00a061f05d
-
SHA512
b4b34a5d2afb59eaa9b91b80e7598c05cf0fc7029a55e18e0540d603fd68dc0af1408caf5551b7c4872b03b79032120fd1fea38fdc8448db63c2ad9d30a3e232
-
SSDEEP
1536:01Tzy48untU8fOMEI3jyYfPiuOB6dVWMSRlUrRF:+zltUeOsaSdVulCr
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2956 1928 4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe 29 PID 1928 wrote to memory of 2956 1928 4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe 29 PID 1928 wrote to memory of 2956 1928 4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe 29 PID 1928 wrote to memory of 2956 1928 4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe 29 PID 2956 wrote to memory of 2336 2956 cmd.exe 30 PID 2956 wrote to memory of 2336 2956 cmd.exe 30 PID 2956 wrote to memory of 2336 2956 cmd.exe 30 PID 2956 wrote to memory of 2336 2956 cmd.exe 30 PID 2336 wrote to memory of 2228 2336 iexpress.exe 31 PID 2336 wrote to memory of 2228 2336 iexpress.exe 31 PID 2336 wrote to memory of 2228 2336 iexpress.exe 31 PID 2336 wrote to memory of 2228 2336 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2AD8.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\4ecf77b051b69dc4a9a4c385753891a0_NEAS.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2228
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
92KB
MD595dedc8033a244e53ba0b5fe7c118d74
SHA1a34c35afa30ea1a6f3db81f149866d6153f1aae3
SHA256d3462073dedc1b67b93a9727339c77d34a4aa79aaf469dc1333f5962967a43aa
SHA5129ff9b49cd72186c247fa5c97228a84c28754b0036e1fbfab12c5adf8cbea44db45172d6da05544b859d9493227c9b601441075118e2140a9a39074f3cef0eae2
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083