Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
07/05/2024, 08:14
General
-
Target
04b2eddf716f9ee4ecf89f68004e5110_NEAS.exe
-
Size
2.7MB
-
MD5
04b2eddf716f9ee4ecf89f68004e5110
-
SHA1
5bf5c320a23f15da9c0c0135d69b9e44ee810f21
-
SHA256
d7ad9153fca552f21476689a7f80853774738c033cdb53981902dfd873aee7d7
-
SHA512
96a46b9f904359b142023b0c618d6df59121d4e7be539c549f610bf6eeeefcdbb610670dc7d386d8fb9b11de6487671a96ac8c159e214477737170b3c784ba6f
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBQ9w4Sx:+R0pI/IQlUoMPdmpSpa4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b2eddf716f9ee4ecf89f68004e5110_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\04b2eddf716f9ee4ecf89f68004e5110_NEAS.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\UserDotGB\xoptisys.exeC:\UserDotGB\xoptisys.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5bae49ec5a2d85ed706c4984bb8276137
SHA17101baae08a3cc28eae475d59822992ca2c583db
SHA256ace6f6f5e416969955d27cab661648524195453868353b36f75a52682f5d336b
SHA5128f52d44c9607ede897a309019e116a3996a32aec47676b35e7869e1a27c1977bc40cb98e6ea55b16ebb77d50f98edb928d0a1df9b391719be76e8b28725d5d0a
-
Filesize
2.7MB
MD561b58d20a121d08d8c810e31503334b0
SHA1543f80f40ce4436d2cdfc8bfd4b8a9679b79ebdc
SHA256b5a45bc2f42b1e791ee8372eba5f4ef1154814ddb0d6e3b132f2686d19dffe66
SHA51200bcf6b2c84b7c0fb264feff0b6aa9a7b5ec9a8bb0755cb786ef11539b8f6b2c74c6caf4abe70176aa1694c02a4624e097018d7f1f2c063f9b3dd886b835e590
-
Filesize
205B
MD54b260e6b8875d3a448c312188493b835
SHA1a6ecb6add0ce54f8a6e72684a417d58afd835969
SHA256f2fe9409699a68bd9855c5056fc234b20f0b7bd33ae049884a51f828375ada99
SHA512ea440d1b6b9ea80ad42cf64833f5a32aebafdddf80c6ba33bd51f3e0e38c97e7597c7a38315114f31b0cca8ad4a314a0af7fd533d4cb0d90f31f002de990b1f7