Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2023, 10:55

General

  • Target

    0tMUNlnakQsCKNd.exe

  • Size

    864KB

  • MD5

    7d424fcd2cfd26574af4acdb87cbe15a

  • SHA1

    d1f2636c0a0a493cbc7522350de7abef29ae4e9e

  • SHA256

    bb741e7ac48085e964e7fdfbd19b97a7376712b09c540a95c9a5f1872034908b

  • SHA512

    5f78ddb361164d642b041db6d26c727519840c28a7f34e9ae8ec9ab3613981717cfec36ab509c04f6fe8b013f25aed8ac7864fe8ab0ff7fd33dc991d1ef9a820

  • SSDEEP

    24576:bUlRu4OyqGUL8ANdsS8hMrVl0nhwcnBH:bUlRu4NqGo8ANuS8hMrr09

Malware Config

Signatures

  • Detect Neshta payload 5 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0tMUNlnakQsCKNd.exe
    "C:\Users\Admin\AppData\Local\Temp\0tMUNlnakQsCKNd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0tMUNlnakQsCKNd.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3828
    • C:\Users\Admin\AppData\Local\Temp\0tMUNlnakQsCKNd.exe
      "C:\Users\Admin\AppData\Local\Temp\0tMUNlnakQsCKNd.exe"
      2⤵
      • Checks computer location settings
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      PID:2760

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

    Filesize

    2.4MB

    MD5

    5d78e8f0ace7d14f7a79f05335a9a361

    SHA1

    e8a375344104bc78ad9145b24e009a71d3acedc3

    SHA256

    9d1ab4e09926ed56abad033d18dbd1de12a7dca6e117b50c93618cc0b9067e64

    SHA512

    91f5015bbe287aa111edc2741d283394807d0ee60c963ecf2de8cb8ce728108fb8706fc6d06e0d498088df1280e9c9098879034d2d5db003b28d1efded15cd64

  • C:\Users\Admin\AppData\Local\Temp\3582-490\0tMUNlnakQsCKNd.exe

    Filesize

    824KB

    MD5

    323918444eecaccd73e5a79ad0733d9a

    SHA1

    d673223b8492119049c3a6f90085c20bfc186325

    SHA256

    dd6d088291d26929238d47fd7f2ef3d9dec778b9659082c4bf84656f7a0d79a8

    SHA512

    f1a91518803e468b9c9e3c90e13aee9d5b6ab3eb06f5926a16fdeb5e003769b10b1d9115c74db69420f687753976c01be10c8be48b0ee83b6412e71a2533a501

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ys3bgtmm.34e.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2300-139-0x00000000089B0000-0x0000000008A4C000-memory.dmp

    Filesize

    624KB

  • memory/2300-137-0x0000000005B30000-0x0000000005B3A000-memory.dmp

    Filesize

    40KB

  • memory/2300-138-0x0000000005940000-0x0000000005950000-memory.dmp

    Filesize

    64KB

  • memory/2300-136-0x0000000005940000-0x0000000005950000-memory.dmp

    Filesize

    64KB

  • memory/2300-135-0x0000000005990000-0x0000000005A22000-memory.dmp

    Filesize

    584KB

  • memory/2300-134-0x0000000005F40000-0x00000000064E4000-memory.dmp

    Filesize

    5.6MB

  • memory/2300-133-0x0000000000EF0000-0x0000000000FCE000-memory.dmp

    Filesize

    888KB

  • memory/2760-157-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2760-140-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2760-141-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2760-142-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2760-196-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3828-160-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/3828-185-0x0000000006590000-0x00000000065AE000-memory.dmp

    Filesize

    120KB

  • memory/3828-161-0x0000000005910000-0x0000000005976000-memory.dmp

    Filesize

    408KB

  • memory/3828-156-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/3828-167-0x00000000059F0000-0x0000000005A56000-memory.dmp

    Filesize

    408KB

  • memory/3828-172-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

    Filesize

    120KB

  • memory/3828-173-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/3828-174-0x0000000007190000-0x00000000071C2000-memory.dmp

    Filesize

    200KB

  • memory/3828-175-0x000000006FBB0000-0x000000006FBFC000-memory.dmp

    Filesize

    304KB

  • memory/3828-159-0x0000000005100000-0x0000000005122000-memory.dmp

    Filesize

    136KB

  • memory/3828-186-0x000000007EE50000-0x000000007EE60000-memory.dmp

    Filesize

    64KB

  • memory/3828-187-0x0000000007920000-0x0000000007F9A000-memory.dmp

    Filesize

    6.5MB

  • memory/3828-188-0x00000000072E0000-0x00000000072FA000-memory.dmp

    Filesize

    104KB

  • memory/3828-189-0x0000000007350000-0x000000000735A000-memory.dmp

    Filesize

    40KB

  • memory/3828-190-0x0000000007560000-0x00000000075F6000-memory.dmp

    Filesize

    600KB

  • memory/3828-191-0x0000000007510000-0x000000000751E000-memory.dmp

    Filesize

    56KB

  • memory/3828-192-0x0000000007620000-0x000000000763A000-memory.dmp

    Filesize

    104KB

  • memory/3828-193-0x0000000007610000-0x0000000007618000-memory.dmp

    Filesize

    32KB

  • memory/3828-146-0x0000000005170000-0x0000000005798000-memory.dmp

    Filesize

    6.2MB

  • memory/3828-145-0x0000000004A00000-0x0000000004A36000-memory.dmp

    Filesize

    216KB