Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07/05/2024, 15:59
General
-
Target
d2904d0160baebf4e39c8772e3349dd0_NEAS.exe
-
Size
359KB
-
MD5
d2904d0160baebf4e39c8772e3349dd0
-
SHA1
bd0a4bda0c4d59296cd3c0a1a5875f250b529c98
-
SHA256
809b2c61db59fd7b9510b145edc50c627051d33bc7e16e1df8c74f568b716da0
-
SHA512
f65c104672038fe0e9c94c2b8a4c0ada7905bb0d430ccd64bcb39bdb4d3345e7ba7945dd1ab4f1314a9ebea80c283f1b75f5052c67758e879264963113d2c366
-
SSDEEP
6144:joz4h3KEL7TlwmKoYVreNsbQXnkwilxlSaF6Kp4q/MgVz4Y5gDKK0LHYtVzbOJo:wqblwToYVreNsbQXnZiDF6Kp4QvVzd5g
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2904d0160baebf4e39c8772e3349dd0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\d2904d0160baebf4e39c8772e3349dd0_NEAS.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2904d0160baebf4e39c8772e3349dd0_NEAS.exeC:\Users\Admin\AppData\Local\Temp\d2904d0160baebf4e39c8772e3349dd0_NEAS.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
359KB
MD52579955d89453ad72b11015cb9b15b1a
SHA17ad9b1bfd77776b9518384ef65332c51bc4d886a
SHA2569ce2a75a6842cc7eca60a4602bc24de1fcdd0b5cf7a81ebcb36a6ba58bd2464e
SHA512a04096c7eaf7d322f5c0230c1d7cdabad1dbbf0a1c80762adc7bf0619329ef03f079c7bc2544a009534ae78d972b2f5183e6e0b74267f75e1a5648dd2c1ca918
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
84KB