Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 03:32

General

  • Target

    5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe

  • Size

    837KB

  • MD5

    816aa88d1695d63d7493ae6d360f235c

  • SHA1

    6ee14a1b7bedd9eaf4042f797d4a06bf1fbdaef6

  • SHA256

    5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba

  • SHA512

    e038533a57ed1a2700775df10f4bc70c1b2b751113d43ce2a597b5811ee72591955bf4d298299b643f83fb97cfd8649d61a9e211c5db511dd5818d63584f95c6

  • SSDEEP

    12288:svGkvn6WIi9aDhoFPp37jtHslw7QdtL8L4f7mpEqUvmyXLgbvVi8lT:kd6WIioDh+PzMlAn1mV8T

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe
    "C:\Users\Admin\AppData\Local\Temp\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe"
    1⤵
    • Modifies system executable filetype association
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\3582-490\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      PID:944
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:884

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3582-490\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe

      Filesize

      797KB

      MD5

      80a81df588ce5e00aed2c7700017d70f

      SHA1

      7774b1577913defabc602362df6e7af3342c2c26

      SHA256

      db4f01c6f043a247e819dbc915d5193f6fff74f57c2086ab5d35355e0f0fbc3e

      SHA512

      975eefc126f0b6f54ef5c613905ebf9ee6ed079b77497428b44c3ba708872e363f9f592474f99361125503b461f25ce3e0adedda4f693e30b21cc03fd4f3e2f3

    • C:\Users\Admin\AppData\Local\Temp\3582-490\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe

      Filesize

      797KB

      MD5

      80a81df588ce5e00aed2c7700017d70f

      SHA1

      7774b1577913defabc602362df6e7af3342c2c26

      SHA256

      db4f01c6f043a247e819dbc915d5193f6fff74f57c2086ab5d35355e0f0fbc3e

      SHA512

      975eefc126f0b6f54ef5c613905ebf9ee6ed079b77497428b44c3ba708872e363f9f592474f99361125503b461f25ce3e0adedda4f693e30b21cc03fd4f3e2f3

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

    • \Users\Admin\AppData\Local\Temp\3582-490\5f17174268a69045cc443295f17a32b76ab2ccd908e3fa0ab880e6a2c0a1a6ba.exe

      Filesize

      797KB

      MD5

      80a81df588ce5e00aed2c7700017d70f

      SHA1

      7774b1577913defabc602362df6e7af3342c2c26

      SHA256

      db4f01c6f043a247e819dbc915d5193f6fff74f57c2086ab5d35355e0f0fbc3e

      SHA512

      975eefc126f0b6f54ef5c613905ebf9ee6ed079b77497428b44c3ba708872e363f9f592474f99361125503b461f25ce3e0adedda4f693e30b21cc03fd4f3e2f3

    • memory/1304-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

      Filesize

      8KB