Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 03:34

General

  • Target

    5c9093be111af01307e6928fd97bab90_NEAS.exe

  • Size

    320KB

  • MD5

    5c9093be111af01307e6928fd97bab90

  • SHA1

    3fc6d5c35ca37605a099345820a7b0080f172d20

  • SHA256

    0cb8668de7d337d721abd9758d8a01d5e99661232c329d039d47adf4407ddaa2

  • SHA512

    e90187ea7e4e7de5c19f791a0c0a232dec55fe8b2e794999dba2ff217c3970945fa730723b297896454e3f1effd5b38abd3fbdb7692e8711db35fb69a6834698

  • SSDEEP

    6144:7FLu2oZ1v2i5mXNWIs05EcHvekBdWD53BDu0W7cyqCxSngmMBqfycuPbUl0i5j:pLuLZ1v2i4XNWIs+hveKi53p80npM4dZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 7 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 384
      2⤵
      • Program crash
      PID:3316
    • C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
      C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:60
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 352
        3⤵
        • Program crash
        PID:3468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 768
        3⤵
        • Program crash
        PID:1192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 788
        3⤵
        • Program crash
        PID:1236
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 776
        3⤵
        • Program crash
        PID:3720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 788
        3⤵
        • Program crash
        PID:736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 820
        3⤵
        • Program crash
        PID:1252
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 388 -ip 388
    1⤵
      PID:4208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 60 -ip 60
      1⤵
        PID:2812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 60 -ip 60
        1⤵
          PID:2724
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 60 -ip 60
          1⤵
            PID:440
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 60 -ip 60
            1⤵
              PID:2024
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 60 -ip 60
              1⤵
                PID:1752
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 60 -ip 60
                1⤵
                  PID:4200

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe

                  Filesize

                  320KB

                  MD5

                  a3cdb17446704b660a175f4a26034f83

                  SHA1

                  83af06c78ba9e31cf6e126c4b40fa602f463d287

                  SHA256

                  b3eb63fec2e6567bc4982a2b90ba2dfc2b8e53bf8224c6fd469b6361b42c5226

                  SHA512

                  0ed06b22a8b99cd6ede3d43d3dbb8a6db091b63266681498e7ad5067e8695e4f6e2b1c9cf7f9d667e1147e4b1d16ad6a9054b93b2d77818226256f58167444d1

                • memory/60-7-0x0000000000400000-0x000000000043C000-memory.dmp

                  Filesize

                  240KB

                • memory/60-8-0x0000000000400000-0x0000000000415000-memory.dmp

                  Filesize

                  84KB

                • memory/60-13-0x0000000004DA0000-0x0000000004DDC000-memory.dmp

                  Filesize

                  240KB

                • memory/388-0-0x0000000000400000-0x000000000043C000-memory.dmp

                  Filesize

                  240KB

                • memory/388-6-0x0000000000400000-0x000000000043C000-memory.dmp

                  Filesize

                  240KB