Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
7c2d61be6904c8c0373e55adac7175c0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7c2d61be6904c8c0373e55adac7175c0_NEAS.exe
Resource
win10v2004-20240226-en
General
-
Target
7c2d61be6904c8c0373e55adac7175c0_NEAS.exe
-
Size
225KB
-
MD5
7c2d61be6904c8c0373e55adac7175c0
-
SHA1
3a004eba5b415bd1667524555a2b93d31c94b5f2
-
SHA256
8d472a1c702b54a5cf4fd917eb3c96ea27c708704773d8361697deb28122f253
-
SHA512
d33b9357ce9b0bbafe2785c5306a9949371acc36a097be70585b6142f4f73dcb87b26d219773e1622bd6eaed7413b558a6fc94c4f04dcb954c2a19871b3f96aa
-
SSDEEP
6144:sA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:sATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\280EC38D = "C:\\Users\\Admin\\AppData\\Roaming\\280EC38D\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe 2760 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2760 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 912 wrote to memory of 2760 912 7c2d61be6904c8c0373e55adac7175c0_NEAS.exe 28 PID 912 wrote to memory of 2760 912 7c2d61be6904c8c0373e55adac7175c0_NEAS.exe 28 PID 912 wrote to memory of 2760 912 7c2d61be6904c8c0373e55adac7175c0_NEAS.exe 28 PID 912 wrote to memory of 2760 912 7c2d61be6904c8c0373e55adac7175c0_NEAS.exe 28 PID 912 wrote to memory of 2760 912 7c2d61be6904c8c0373e55adac7175c0_NEAS.exe 28 PID 2760 wrote to memory of 1212 2760 winver.exe 21 PID 2760 wrote to memory of 1132 2760 winver.exe 19 PID 2760 wrote to memory of 1176 2760 winver.exe 20 PID 2760 wrote to memory of 1212 2760 winver.exe 21 PID 2760 wrote to memory of 912 2760 winver.exe 27
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7c2d61be6904c8c0373e55adac7175c0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\7c2d61be6904c8c0373e55adac7175c0_NEAS.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2760
-
-