Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
5c9093be111af01307e6928fd97bab90_NEAS.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5c9093be111af01307e6928fd97bab90_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
5c9093be111af01307e6928fd97bab90_NEAS.exe
-
Size
320KB
-
MD5
5c9093be111af01307e6928fd97bab90
-
SHA1
3fc6d5c35ca37605a099345820a7b0080f172d20
-
SHA256
0cb8668de7d337d721abd9758d8a01d5e99661232c329d039d47adf4407ddaa2
-
SHA512
e90187ea7e4e7de5c19f791a0c0a232dec55fe8b2e794999dba2ff217c3970945fa730723b297896454e3f1effd5b38abd3fbdb7692e8711db35fb69a6834698
-
SSDEEP
6144:7FLu2oZ1v2i5mXNWIs05EcHvekBdWD53BDu0W7cyqCxSngmMBqfycuPbUl0i5j:pLuLZ1v2i4XNWIs+hveKi53p80npM4dZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 60 5c9093be111af01307e6928fd97bab90_NEAS.exe -
Executes dropped EXE 1 IoCs
pid Process 60 5c9093be111af01307e6928fd97bab90_NEAS.exe -
Program crash 7 IoCs
pid pid_target Process procid_target 3316 388 WerFault.exe 82 3468 60 WerFault.exe 89 1192 60 WerFault.exe 89 1236 60 WerFault.exe 89 3720 60 WerFault.exe 89 736 60 WerFault.exe 89 1252 60 WerFault.exe 89 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 388 5c9093be111af01307e6928fd97bab90_NEAS.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 60 5c9093be111af01307e6928fd97bab90_NEAS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 388 wrote to memory of 60 388 5c9093be111af01307e6928fd97bab90_NEAS.exe 89 PID 388 wrote to memory of 60 388 5c9093be111af01307e6928fd97bab90_NEAS.exe 89 PID 388 wrote to memory of 60 388 5c9093be111af01307e6928fd97bab90_NEAS.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 3842⤵
- Program crash
PID:3316
-
-
C:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exeC:\Users\Admin\AppData\Local\Temp\5c9093be111af01307e6928fd97bab90_NEAS.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:60 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 3523⤵
- Program crash
PID:3468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 7683⤵
- Program crash
PID:1192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 7883⤵
- Program crash
PID:1236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 7763⤵
- Program crash
PID:3720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 7883⤵
- Program crash
PID:736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 8203⤵
- Program crash
PID:1252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 388 -ip 3881⤵PID:4208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 60 -ip 601⤵PID:2812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 60 -ip 601⤵PID:2724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 60 -ip 601⤵PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 60 -ip 601⤵PID:2024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 60 -ip 601⤵PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 60 -ip 601⤵PID:4200
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD5a3cdb17446704b660a175f4a26034f83
SHA183af06c78ba9e31cf6e126c4b40fa602f463d287
SHA256b3eb63fec2e6567bc4982a2b90ba2dfc2b8e53bf8224c6fd469b6361b42c5226
SHA5120ed06b22a8b99cd6ede3d43d3dbb8a6db091b63266681498e7ad5067e8695e4f6e2b1c9cf7f9d667e1147e4b1d16ad6a9054b93b2d77818226256f58167444d1