Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
2b02c876184dd6d5ab58544068f7e985_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b02c876184dd6d5ab58544068f7e985_NEAS.exe
Resource
win10v2004-20240426-en
General
-
Target
2b02c876184dd6d5ab58544068f7e985_NEAS.exe
-
Size
32KB
-
MD5
2b02c876184dd6d5ab58544068f7e985
-
SHA1
cadf76b85078132a34c5dd647d93a5206bf63837
-
SHA256
6c5600118b94c410568e03c869ee6041505401f7cf8c232f35c1b999801da47e
-
SHA512
8233fdf530c711df0cbe0a75fb3b66df771d2ee3590bb68b22a4e9d5d12173109cf995076981a3e094a865ee87baba66202a7779912392e3d89f81690825df84
-
SSDEEP
768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhi:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2564 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2564 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 2b02c876184dd6d5ab58544068f7e985_NEAS.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 2b02c876184dd6d5ab58544068f7e985_NEAS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2564 3408 2b02c876184dd6d5ab58544068f7e985_NEAS.exe 82 PID 3408 wrote to memory of 2564 3408 2b02c876184dd6d5ab58544068f7e985_NEAS.exe 82 PID 3408 wrote to memory of 2564 3408 2b02c876184dd6d5ab58544068f7e985_NEAS.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b02c876184dd6d5ab58544068f7e985_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\2b02c876184dd6d5ab58544068f7e985_NEAS.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD58a5e11ad35a656e31547b3cfb597f027
SHA1f090c2786e6777c11e6bd557b53175f36c78b5fe
SHA256463db652636f810b8cb95566f5fb4edcd3f3861dee3b30f0832c9355194da179
SHA512b1c8cb43f4c2dfdcd74f342677a657f5a8017ec5a9689bf0c7a260d6cfedaa06fb8f8b0a8b26ef48093d58b071697a09ff72bc9965ccf89973d22a9c48e2b345