Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 20:10

General

  • Target

    f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

  • Size

    1.6MB

  • MD5

    6c040a3189d4bdf364a046b5b7b2a087

  • SHA1

    ebefcc8aa9e12cde34d590523e932a342b24cff1

  • SHA256

    f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392

  • SHA512

    f94c367f1d04182b8f656c55783723b8c8ed6459ce2d3696aada22befdd3d4ae0105f4aa5d1fdefbd9ece6147d53ecacd4b3e191c58bd8fa2be072330023fcd1

  • SSDEEP

    49152:g2y9WkzTwQlLQ34X4omdTIWiNVVdowqGKoPd:UjgFdTt2VY4V

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe
    "C:\Users\Admin\AppData\Local\Temp\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe"
      2⤵
      • Executes dropped EXE
      PID:2656

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

    Filesize

    1.5MB

    MD5

    4f9b6fc24f066c03bc29585cbaf36116

    SHA1

    68d3206126c62b53d7a1953bac261651e10fc635

    SHA256

    510246e250c5535b5262f6bb38bcf4d116567fea9969c4c10104f638a9add722

    SHA512

    da0b129d4a0ae59aae811fe8deb8670c33b13e5db715f290f88345d8c480de780018dc13562eca6620c33d93625b75a519bd05963b3f74b2111008bf83d78e1a

  • C:\Users\Admin\AppData\Local\Temp\3582-490\f3dd0247b284a8caa1092fe38a01d8792cbb46911fab9b7dd6e56e10f3e7c392.exe

    Filesize

    1.5MB

    MD5

    4f9b6fc24f066c03bc29585cbaf36116

    SHA1

    68d3206126c62b53d7a1953bac261651e10fc635

    SHA256

    510246e250c5535b5262f6bb38bcf4d116567fea9969c4c10104f638a9add722

    SHA512

    da0b129d4a0ae59aae811fe8deb8670c33b13e5db715f290f88345d8c480de780018dc13562eca6620c33d93625b75a519bd05963b3f74b2111008bf83d78e1a

  • memory/2656-135-0x0000000000400000-0x0000000000826000-memory.dmp

    Filesize

    4.1MB