Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    80s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 23:07

General

  • Target

    1f7184ff26bf0e67dd74606ea389dd72.exe

  • Size

    1.3MB

  • MD5

    1f7184ff26bf0e67dd74606ea389dd72

  • SHA1

    11f7a3c81ea702bfe2c91182da7569260ad704d4

  • SHA256

    59b215f81c5c5f4c6148f8d349aec9f9645101a825d2b3f7c7078abf47a6cb99

  • SHA512

    5e32b688783b6fe5d55252a85007ee3e341191c664d24e69aeb8ba06cf19f979539f161d8828d00f6554d144b27ca0deae0d992ee8bb0e08d5758776d4b6b5c6

  • SSDEEP

    24576:afKb+GlrPj37VzHEA6B3vDaCCGkJ/bcXExy4FqpaXIaraXIaXIaXIaXIara4:aCtrPj37VzHEA6B/tCGAVpqCO111v

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f7184ff26bf0e67dd74606ea389dd72.exe
    "C:\Users\Admin\AppData\Local\Temp\1f7184ff26bf0e67dd74606ea389dd72.exe"
    1⤵
      PID:444
      • C:\Users\Admin\AppData\Local\Temp\3582-490\1f7184ff26bf0e67dd74606ea389dd72.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\1f7184ff26bf0e67dd74606ea389dd72.exe"
        2⤵
          PID:4624

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

        Filesize

        2.4MB

        MD5

        8ffc3bdf4a1903d9e28b99d1643fc9c7

        SHA1

        919ba8594db0ae245a8abd80f9f3698826fc6fe5

        SHA256

        8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

        SHA512

        0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

      • C:\Users\Admin\AppData\Local\Temp\3582-490\1f7184ff26bf0e67dd74606ea389dd72.exe

        Filesize

        15KB

        MD5

        ef478962d8b225eda79def4be5ba4234

        SHA1

        4e896e9836d3d072aba7ef200f7cb1cd9f0cf362

        SHA256

        f2ea1a79c3f17170e68508ed56089cc451af136cdb4f4401ec4e546347e5d376

        SHA512

        36506800178bcf2a7cb62a18321cca3bdf69888e457b34c8ee380e15e440b7b090ff61aa163ce46822ef6d89392c0820862a88a6fbfb1aa70b88e58baaca6251

      • C:\Users\Admin\AppData\Local\Temp\3582-490\1f7184ff26bf0e67dd74606ea389dd72.exe

        Filesize

        1.2MB

        MD5

        47d4d3ec9834abb75a0a44f74ca0bce2

        SHA1

        629f335a8dc2f35183b84681f182a96e683b35e2

        SHA256

        acea87fa2bd64f930e01a4f38bf79042933ab0a5128c1d7cd286a04ba329e091

        SHA512

        516a94a46c7841553b9aaf986e2bf7d709f99ee14b57dce7f5a42998044c8fe8ab9ed8a4a730e99bc431de8b4bb4d41ba3d1f33944e6b2ca893374c469e9018d

      • memory/444-97-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/444-98-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/444-100-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

      • memory/4624-10-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB