Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 01:06
Behavioral task
behavioral1
Sample
Autoruns.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Autoruns.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
Autoruns.exe
-
Size
1.7MB
-
MD5
62055a93170cc7c217a0a868c22092c4
-
SHA1
8c4df4991870eda0d75582e0014d47581d121186
-
SHA256
3cf82d4de6477ab708aa25dabb2ddb341b98f5ba66dd6441851ab425b8470de3
-
SHA512
464c4eb9f4b0fe0ecbc10412102bb5b0f94499af6df2040bc41d89ecd8934e0d3cdcc3cb50d7926c2158bcc92337567f2b9c0f1347d1db0f2e39bf69fc014526
-
SSDEEP
12288:1HZrVs162LpM5mzIhM6jl8/yX0Chz8rgRO6u2TdimrfZetCvmKT6IQViL/MW5bkB:q0qQhMIX0e8uOR2xZnkiYWZkB
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 4 IoCs
resource yara_rule behavioral2/files/0x000600000002003c-14.dat family_neshta behavioral2/memory/1116-97-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1116-98-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1116-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation Autoruns.exe -
Executes dropped EXE 1 IoCs
pid Process 1824 Autoruns.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Autoruns.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe Autoruns.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MI391D~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MIA062~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe Autoruns.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~3.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Autoruns.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13181~1.5\MICROS~2.EXE Autoruns.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Autoruns.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE Autoruns.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com Autoruns.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Autoruns.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1824 1116 Autoruns.exe 85 PID 1116 wrote to memory of 1824 1116 Autoruns.exe 85 PID 1116 wrote to memory of 1824 1116 Autoruns.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autoruns.exe"C:\Users\Admin\AppData\Local\Temp\Autoruns.exe"1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Autoruns.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Autoruns.exe"2⤵
- Executes dropped EXE
PID:1824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD58ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA2568268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA5120b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
-
Filesize
1.7MB
MD517bd13edd536269c417ba8e1b4534fbe
SHA122470bb3a4c37a0c612ff7ad2596306065ac0c9b
SHA2566111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb
SHA51200d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455