Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 10:06

General

  • Target

    36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe

  • Size

    4.4MB

  • MD5

    36b05b5575e0b5cf3ad1e5fc378175f0

  • SHA1

    0671416378c8619e618c8b7f6eebc29409c35166

  • SHA256

    7e6a71d4114f88e1d601f7218de07176c2d79c6aef24996d0d9b24f012e39e43

  • SHA512

    851e1125f72a085f08f2fe23bdf2fe62bf2ed56a5c59c33a093da2f1fdd8289a153567d408dd79e80402ed9bcaa067fbfb3243f97f1ec3dd971ed64f932a490a

  • SSDEEP

    98304:FWDUz94u+H0RFyYWuTEOd0XIyplGjvVAD8ocjIpPodLmpZ:oo7+kEupqXGjvVTHjpd

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\36b05b5575e0b5cf3ad1e5fc378175f0_NEAS.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

    Filesize

    56B

    MD5

    ca1fb4add2d3d0ff77cc28b4ff2fe8a6

    SHA1

    9f7643fcb09a3b3e9ae4b6765f1e6d17cd6b3c3b

    SHA256

    2fd0513a15986296cc9e60d963e613050eecf7ddb6e3751c44beb20b793ff0e9

    SHA512

    87679923e00ec41bf132718f9f32cd7e2103374bb2711468765ffeedcbadbfecf61021d1657578998fa010bee6be4f7579bfa36fda7aae3824ea8cabc621c549

  • C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

    Filesize

    96B

    MD5

    c4daf67eabec4e1d9dbebb9588f06344

    SHA1

    48dee881f6504dac4ad6cc59c00f8c788b30e9f7

    SHA256

    60b229bca26f8bf70d1347e0e9a450e0a991dcc9051cb8496dfde682c20d23a5

    SHA512

    dc28eafd2ca9bb6d817d992df80d6ed74fb31567f361c4323d1d39dfcd864d7155397238a357c79372d64df175113cca0f6597f5492fc7b5b0cba04ffb7734f4

  • C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

    Filesize

    510B

    MD5

    558a629bad5b8c71d8bd79fade034794

    SHA1

    ad6153864f775b04cea448e657bcae1331249b44

    SHA256

    fb14e7665c13ecf1de00cf2b5464d3aa005fecca9d382ffb11f975ebb27faa70

    SHA512

    ffbf0bdf792c7dfca67ebe3422d3d386db72e8de25502d56080c7e072b520df0adddc826a0fcd83496a0316a55a1dac814a582917b888168ddbf88e862318963

  • C:\Users\Admin\AppData\Local\Temp\User Data\Setting.set

    Filesize

    36B

    MD5

    795c0ee5e9bdb35d6844f7898aaf75d2

    SHA1

    5609d819c7755020f10bd896590e16118ce92b02

    SHA256

    f9c70ebbc12852743b08d71afde13c5bc1fa18469212b184468345645880dc73

    SHA512

    ced8ba28a76fc904918965c0fa85ef9c05fa4958624418a7292f5baba7e6f24d891937f7e9b2d990d61172f40a4eae0149fe08bf2281ae453fe0f53ac213d899

  • memory/2360-74-0x00000000057C0000-0x00000000057C1000-memory.dmp

    Filesize

    4KB

  • memory/2360-75-0x00000000057D0000-0x00000000057D1000-memory.dmp

    Filesize

    4KB

  • memory/2360-0-0x0000000000400000-0x0000000000FBB000-memory.dmp

    Filesize

    11.7MB

  • memory/2360-73-0x00000000057B0000-0x00000000057B1000-memory.dmp

    Filesize

    4KB

  • memory/2360-72-0x00000000057A0000-0x00000000057A1000-memory.dmp

    Filesize

    4KB

  • memory/2360-71-0x0000000005780000-0x0000000005781000-memory.dmp

    Filesize

    4KB

  • memory/2360-70-0x0000000005770000-0x0000000005771000-memory.dmp

    Filesize

    4KB

  • memory/2360-80-0x00000000057F0000-0x00000000057F1000-memory.dmp

    Filesize

    4KB

  • memory/2360-79-0x00000000057E0000-0x00000000057E1000-memory.dmp

    Filesize

    4KB