Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 03:34

General

  • Target

    5c9093be111af01307e6928fd97bab90_NEAS.exe

  • Size

    320KB

  • MD5

    5c9093be111af01307e6928fd97bab90

  • SHA1

    3fc6d5c35ca37605a099345820a7b0080f172d20

  • SHA256

    0cb8668de7d337d721abd9758d8a01d5e99661232c329d039d47adf4407ddaa2

  • SHA512

    e90187ea7e4e7de5c19f791a0c0a232dec55fe8b2e794999dba2ff217c3970945fa730723b297896454e3f1effd5b38abd3fbdb7692e8711db35fb69a6834698

  • SSDEEP

    6144:7FLu2oZ1v2i5mXNWIs05EcHvekBdWD53BDu0W7cyqCxSngmMBqfycuPbUl0i5j:pLuLZ1v2i4XNWIs+hveKi53p80npM4dZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
      C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe

    Filesize

    320KB

    MD5

    e0f0c9c7dac6cbdcc257ec9eb8570d1d

    SHA1

    4c86a783e1ea2afc3713168379fc05b3ad21d026

    SHA256

    9e0b6dd5699a58488e487537109b87d8e74fa55f342e178a4c8704d2c3317b33

    SHA512

    47c627fbd73a9149256e4cb520937df78d5736da56fb6c5515f3c8f81f6ae8cec8924b40d232dac6d79ce8fe6fdc710ec14dffb22f7794b3bd934d6f4055315a

  • memory/2028-0-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2028-5-0x0000000000130000-0x000000000016C000-memory.dmp

    Filesize

    240KB

  • memory/2028-9-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2428-12-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2428-11-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2428-17-0x0000000000200000-0x000000000023C000-memory.dmp

    Filesize

    240KB