Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 01:06
Behavioral task
behavioral1
Sample
Autoruns.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Autoruns.exe
Resource
win10v2004-20231215-en
General
-
Target
Autoruns.exe
-
Size
1.7MB
-
MD5
62055a93170cc7c217a0a868c22092c4
-
SHA1
8c4df4991870eda0d75582e0014d47581d121186
-
SHA256
3cf82d4de6477ab708aa25dabb2ddb341b98f5ba66dd6441851ab425b8470de3
-
SHA512
464c4eb9f4b0fe0ecbc10412102bb5b0f94499af6df2040bc41d89ecd8934e0d3cdcc3cb50d7926c2158bcc92337567f2b9c0f1347d1db0f2e39bf69fc014526
-
SSDEEP
12288:1HZrVs162LpM5mzIhM6jl8/yX0Chz8rgRO6u2TdimrfZetCvmKT6IQViL/MW5bkB:q0qQhMIX0e8uOR2xZnkiYWZkB
Malware Config
Signatures
-
Detect Neshta payload 3 IoCs
resource yara_rule behavioral1/files/0x000100000001030e-10.dat family_neshta behavioral1/memory/2264-83-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2264-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
pid Process 3004 Autoruns.exe -
Loads dropped DLL 2 IoCs
pid Process 2264 Autoruns.exe 2264 Autoruns.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Autoruns.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Autoruns.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe Autoruns.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe Autoruns.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe Autoruns.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe Autoruns.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com Autoruns.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Autoruns.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3004 Autoruns.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 3004 2264 Autoruns.exe 28 PID 2264 wrote to memory of 3004 2264 Autoruns.exe 28 PID 2264 wrote to memory of 3004 2264 Autoruns.exe 28 PID 2264 wrote to memory of 3004 2264 Autoruns.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autoruns.exe"C:\Users\Admin\AppData\Local\Temp\Autoruns.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Autoruns.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Autoruns.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
1.7MB
MD517bd13edd536269c417ba8e1b4534fbe
SHA122470bb3a4c37a0c612ff7ad2596306065ac0c9b
SHA2566111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb
SHA51200d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455