Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    tmp

  • Size

    3.4MB

  • Sample

    230315-1xre7afe42

  • MD5

    825c1b8271c7a89060514ccb1ddfdd27

  • SHA1

    75b4505c8275855a9e15497d0d364c800b9d15fe

  • SHA256

    3956258994c42b8394da2ca90e95313ad870f6611c0b2ce86c9cd247b57ae6f8

  • SHA512

    2371a056ed6524f331d3c771d2e71a46ce879068bd7174e1c82905c999d44647e8d0ba7817ea749b75f005e20beb83edb158a8995bfd4ad1e59fa4821b382ace

  • SSDEEP

    98304:WRVPnq1y5tQOM33ZNqCtBixHl54Oyjes1boc9:IVPq1yLanrqTr43eSl

Malware Config

Targets

    • Target

      tmp

    • Size

      3.4MB

    • MD5

      825c1b8271c7a89060514ccb1ddfdd27

    • SHA1

      75b4505c8275855a9e15497d0d364c800b9d15fe

    • SHA256

      3956258994c42b8394da2ca90e95313ad870f6611c0b2ce86c9cd247b57ae6f8

    • SHA512

      2371a056ed6524f331d3c771d2e71a46ce879068bd7174e1c82905c999d44647e8d0ba7817ea749b75f005e20beb83edb158a8995bfd4ad1e59fa4821b382ace

    • SSDEEP

      98304:WRVPnq1y5tQOM33ZNqCtBixHl54Oyjes1boc9:IVPq1yLanrqTr43eSl

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Contacts a large (896) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks