Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 23:07
Behavioral task
behavioral1
Sample
1f7184ff26bf0e67dd74606ea389dd72.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1f7184ff26bf0e67dd74606ea389dd72.exe
Resource
win10v2004-20231222-en
General
-
Target
1f7184ff26bf0e67dd74606ea389dd72.exe
-
Size
1.3MB
-
MD5
1f7184ff26bf0e67dd74606ea389dd72
-
SHA1
11f7a3c81ea702bfe2c91182da7569260ad704d4
-
SHA256
59b215f81c5c5f4c6148f8d349aec9f9645101a825d2b3f7c7078abf47a6cb99
-
SHA512
5e32b688783b6fe5d55252a85007ee3e341191c664d24e69aeb8ba06cf19f979539f161d8828d00f6554d144b27ca0deae0d992ee8bb0e08d5758776d4b6b5c6
-
SSDEEP
24576:afKb+GlrPj37VzHEA6B3vDaCCGkJ/bcXExy4FqpaXIaraXIaXIaXIaXIara4:aCtrPj37VzHEA6B/tCGAVpqCO111v
Malware Config
Signatures
-
Detect Neshta payload 4 IoCs
resource yara_rule behavioral2/files/0x0006000000020051-14.dat family_neshta behavioral2/memory/444-97-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/444-98-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/444-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f7184ff26bf0e67dd74606ea389dd72.exe"C:\Users\Admin\AppData\Local\Temp\1f7184ff26bf0e67dd74606ea389dd72.exe"1⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1f7184ff26bf0e67dd74606ea389dd72.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1f7184ff26bf0e67dd74606ea389dd72.exe"2⤵PID:4624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD58ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA2568268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA5120b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
-
Filesize
15KB
MD5ef478962d8b225eda79def4be5ba4234
SHA14e896e9836d3d072aba7ef200f7cb1cd9f0cf362
SHA256f2ea1a79c3f17170e68508ed56089cc451af136cdb4f4401ec4e546347e5d376
SHA51236506800178bcf2a7cb62a18321cca3bdf69888e457b34c8ee380e15e440b7b090ff61aa163ce46822ef6d89392c0820862a88a6fbfb1aa70b88e58baaca6251
-
Filesize
1.2MB
MD547d4d3ec9834abb75a0a44f74ca0bce2
SHA1629f335a8dc2f35183b84681f182a96e683b35e2
SHA256acea87fa2bd64f930e01a4f38bf79042933ab0a5128c1d7cd286a04ba329e091
SHA512516a94a46c7841553b9aaf986e2bf7d709f99ee14b57dce7f5a42998044c8fe8ab9ed8a4a730e99bc431de8b4bb4d41ba3d1f33944e6b2ca893374c469e9018d