Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 20:10

General

  • Target

    f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

  • Size

    1.6MB

  • MD5

    6c040a3189d4bdf364a046b5b7b2a087

  • SHA1

    ebefcc8aa9e12cde34d590523e932a342b24cff1

  • SHA256

    f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392

  • SHA512

    f94c367f1d04182b8f656c55783723b8c8ed6459ce2d3696aada22befdd3d4ae0105f4aa5d1fdefbd9ece6147d53ecacd4b3e191c58bd8fa2be072330023fcd1

  • SSDEEP

    49152:g2y9WkzTwQlLQ34X4omdTIWiNVVdowqGKoPd:UjgFdTt2VY4V

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe
    "C:\Users\Admin\AppData\Local\Temp\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe"
      2⤵
      • Executes dropped EXE
      PID:2040

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

    Filesize

    1.5MB

    MD5

    4f9b6fc24f066c03bc29585cbaf36116

    SHA1

    68d3206126c62b53d7a1953bac261651e10fc635

    SHA256

    510246e250c5535b5262f6bb38bcf4d116567fea9969c4c10104f638a9add722

    SHA512

    da0b129d4a0ae59aae811fe8deb8670c33b13e5db715f290f88345d8c480de780018dc13562eca6620c33d93625b75a519bd05963b3f74b2111008bf83d78e1a

  • C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

    Filesize

    1.5MB

    MD5

    4f9b6fc24f066c03bc29585cbaf36116

    SHA1

    68d3206126c62b53d7a1953bac261651e10fc635

    SHA256

    510246e250c5535b5262f6bb38bcf4d116567fea9969c4c10104f638a9add722

    SHA512

    da0b129d4a0ae59aae811fe8deb8670c33b13e5db715f290f88345d8c480de780018dc13562eca6620c33d93625b75a519bd05963b3f74b2111008bf83d78e1a

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

  • \Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

    Filesize

    1.5MB

    MD5

    4f9b6fc24f066c03bc29585cbaf36116

    SHA1

    68d3206126c62b53d7a1953bac261651e10fc635

    SHA256

    510246e250c5535b5262f6bb38bcf4d116567fea9969c4c10104f638a9add722

    SHA512

    da0b129d4a0ae59aae811fe8deb8670c33b13e5db715f290f88345d8c480de780018dc13562eca6620c33d93625b75a519bd05963b3f74b2111008bf83d78e1a

  • \Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

    Filesize

    1.5MB

    MD5

    4f9b6fc24f066c03bc29585cbaf36116

    SHA1

    68d3206126c62b53d7a1953bac261651e10fc635

    SHA256

    510246e250c5535b5262f6bb38bcf4d116567fea9969c4c10104f638a9add722

    SHA512

    da0b129d4a0ae59aae811fe8deb8670c33b13e5db715f290f88345d8c480de780018dc13562eca6620c33d93625b75a519bd05963b3f74b2111008bf83d78e1a

  • memory/1784-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

    Filesize

    8KB

  • memory/1784-60-0x0000000002610000-0x0000000002A36000-memory.dmp

    Filesize

    4.1MB

  • memory/2040-61-0x0000000000400000-0x0000000000826000-memory.dmp

    Filesize

    4.1MB