Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca5598376def17dbd0338edd6ad237f0_NEAS.exe
Resource
win7-20240419-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca5598376def17dbd0338edd6ad237f0_NEAS.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ca5598376def17dbd0338edd6ad237f0_NEAS.exe
-
Size
69KB
-
MD5
ca5598376def17dbd0338edd6ad237f0
-
SHA1
0208f2287739dc748b6abad1f6bcb7383fc6d09f
-
SHA256
6b429aa1d0d27695c2dc672c2960151b8e0c8706bcec89332de8491cbf29902b
-
SHA512
5f931ebf605e628b1c6fc741c283d7ee1c5e86313dacd44de513243e7be00a75dcfc403f34cb2bea5e929010a6ab16edd5c986c2ee2e2d6118164d2de0187820
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Dg:Olg35GTslA5t3/w8Dg
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" igputes.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c} igputes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c}\IsInstalled = "1" igputes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C464B54-444a-474c-4C46-4B54444A474c}\StubPath = "C:\\Windows\\system32\\eafcoanut-otoot.exe" igputes.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" igputes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouploarur.exe" igputes.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe igputes.exe -
Executes dropped EXE 2 IoCs
pid Process 4568 igputes.exe 4808 igputes.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" igputes.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" igputes.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} igputes.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify igputes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" igputes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oukdoafib-uxac.dll" igputes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" igputes.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igputes.exe ca5598376def17dbd0338edd6ad237f0_NEAS.exe File created C:\Windows\SysWOW64\igputes.exe ca5598376def17dbd0338edd6ad237f0_NEAS.exe File created C:\Windows\SysWOW64\ouploarur.exe igputes.exe File opened for modification C:\Windows\SysWOW64\eafcoanut-otoot.exe igputes.exe File opened for modification C:\Windows\SysWOW64\ouploarur.exe igputes.exe File created C:\Windows\SysWOW64\eafcoanut-otoot.exe igputes.exe File opened for modification C:\Windows\SysWOW64\oukdoafib-uxac.dll igputes.exe File created C:\Windows\SysWOW64\oukdoafib-uxac.dll igputes.exe File opened for modification C:\Windows\SysWOW64\igputes.exe igputes.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4808 igputes.exe 4808 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe 4568 igputes.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3540 ca5598376def17dbd0338edd6ad237f0_NEAS.exe Token: SeDebugPrivilege 4568 igputes.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4568 3540 ca5598376def17dbd0338edd6ad237f0_NEAS.exe 84 PID 3540 wrote to memory of 4568 3540 ca5598376def17dbd0338edd6ad237f0_NEAS.exe 84 PID 3540 wrote to memory of 4568 3540 ca5598376def17dbd0338edd6ad237f0_NEAS.exe 84 PID 4568 wrote to memory of 612 4568 igputes.exe 5 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 4808 4568 igputes.exe 85 PID 4568 wrote to memory of 4808 4568 igputes.exe 85 PID 4568 wrote to memory of 4808 4568 igputes.exe 85 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56 PID 4568 wrote to memory of 3524 4568 igputes.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\ca5598376def17dbd0338edd6ad237f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\ca5598376def17dbd0338edd6ad237f0_NEAS.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\igputes.exe"C:\Windows\system32\igputes.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\igputes.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD55a8867337841b47410f7dad1f330152f
SHA17be802f623608671e3c543d6f0dffb2badca5349
SHA2567ac05d90a0c6084b4754df9273f7744023e9beb78b3ef75191b216682196bf65
SHA5124c1cd9ccab2f7e83f5efbe70acc086643ef00f9e70203729f362f19e69362da192fe4b489a3f7c9c7eb53402def6d8738893895a1d0049eb4594bd7760f8c56b
-
Filesize
69KB
MD5ca5598376def17dbd0338edd6ad237f0
SHA10208f2287739dc748b6abad1f6bcb7383fc6d09f
SHA2566b429aa1d0d27695c2dc672c2960151b8e0c8706bcec89332de8491cbf29902b
SHA5125f931ebf605e628b1c6fc741c283d7ee1c5e86313dacd44de513243e7be00a75dcfc403f34cb2bea5e929010a6ab16edd5c986c2ee2e2d6118164d2de0187820
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD590e482823106bddd676c98583c12c563
SHA14e8e1dc392939718cdaf85c2ef865ab4e6c1760f
SHA25641a8bac3076458d72e41e49c3765d1d63ac7524448bd901e8a5c7ba2044cf5b7
SHA512dc966d1565a3e3bf9b8fb51d5e98967da78619772b20b8bb0c26c3cfbc5dfa0bce85a09affbca0108462943f52bd9d125509b4bc466f292846e3827523638278