Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
07/05/2024, 03:34
General
-
Target
5c9093be111af01307e6928fd97bab90_NEAS.exe
-
Size
320KB
-
MD5
5c9093be111af01307e6928fd97bab90
-
SHA1
3fc6d5c35ca37605a099345820a7b0080f172d20
-
SHA256
0cb8668de7d337d721abd9758d8a01d5e99661232c329d039d47adf4407ddaa2
-
SHA512
e90187ea7e4e7de5c19f791a0c0a232dec55fe8b2e794999dba2ff217c3970945fa730723b297896454e3f1effd5b38abd3fbdb7692e8711db35fb69a6834698
-
SSDEEP
6144:7FLu2oZ1v2i5mXNWIs05EcHvekBdWD53BDu0W7cyqCxSngmMBqfycuPbUl0i5j:pLuLZ1v2i4XNWIs+hveKi53p80npM4dZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exeC:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD5e0f0c9c7dac6cbdcc257ec9eb8570d1d
SHA14c86a783e1ea2afc3713168379fc05b3ad21d026
SHA2569e0b6dd5699a58488e487537109b87d8e74fa55f342e178a4c8704d2c3317b33
SHA51247c627fbd73a9149256e4cb520937df78d5736da56fb6c5515f3c8f81f6ae8cec8924b40d232dac6d79ce8fe6fdc710ec14dffb22f7794b3bd934d6f4055315a
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
84KB
-
Filesize
240KB
-
Filesize
240KB