Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

63e108d086...AS.exe

windows7-x64

7

63e108d086...AS.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 04:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63e108d0862cdbcb73c9f2051751d460_NEAS.exe

  • Size

    4.1MB

  • MD5

    63e108d0862cdbcb73c9f2051751d460

  • SHA1

    88d1f13c81988e19fef21a4fb4b866c6d136904c

  • SHA256

    7d27f194b965426f9a013c8d508321ae6769d3d5d4cbb7279821a0bb2dca157e

  • SHA512

    144173c1eb0fe4ea6017ece816073a51d30abb5f0393f20a3aad15e96465a7b81564f9bfe47a02df3e5e233ce725a3845a22859e1730fa26e743d5fd02d6fa19

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpy4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmR5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63e108d0862cdbcb73c9f2051751d460_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\63e108d0862cdbcb73c9f2051751d460_NEAS.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Files05\devoptiec.exe
      C:\Files05\devoptiec.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Files05\devoptiec.exe
    Filesize

    4.1MB

    MD5

    ed99ad393e09cf32f5120cd7306d1b0f

    SHA1

    89f6c7fdd58f6387bc59063e45ad0c5af0ae47e1

    SHA256

    d1cc4025a6629ef5228520edb673aa686e009c060488794b171e50ea39ed3bae

    SHA512

    38d9bd360597e279237c8c87a0cee598206fdbdd01b5c0bc43487bf4b566521406912e6649dd9e14bd275ba62dfd04a595bd2b7d481e385e8df841b3578a839a

    Download Submit

  • C:\Mint8V\bodxsys.exe
    Filesize

    4.1MB

    MD5

    4abed73fb36eb4532baaf69572051249

    SHA1

    532b7bd2f242851ab9ed68ece457942ff20e5e76

    SHA256

    3783e0fe0520143f3ec7b05dac9211699242ee6b90607e6e5532b78800d774cc

    SHA512

    586a04f382fa3b1d2c669ad8bd817298d3de5781e011725f768771c527d9abae27c91db41a595a2d742ad84fb4befeaf51ef04c014784d01d17acb10568ae409

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    202B

    MD5

    d6743c64d31327e3dcc32e6a092ba11b

    SHA1

    afa539e0c599d05a38fef34064d97371daa74dcb

    SHA256

    4e3f609d9589a2164efa92ed5beb7fcced2ab0be65874fba4e8da8efee0e3d3f

    SHA512

    756687f07bfcc4503fd35ad385a645de029ca14b0136b98e2dd8a34515a33fc2575ecff86ae9101fe1433ddb284a7a39c889603c4f262acb75109e61055b5801

    Download Submit