Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1Neptune-main.zip
windows7-x64
1Neptune-main.zip
windows10-2004-x64
1Neptune-ma...DME.md
windows7-x64
3Neptune-ma...DME.md
windows10-2004-x64
3Neptune-ma...e here
windows7-x64
1Neptune-ma...e here
windows10-2004-x64
1Neptune-ma...une.py
windows7-x64
3Neptune-ma...une.py
windows10-2004-x64
3Neptune-ma...ts.txt
windows7-x64
1Neptune-ma...ts.txt
windows10-2004-x64
1Neptune-ma...up.bat
windows7-x64
1Neptune-ma...up.bat
windows10-2004-x64
1Neptune-ma...al.txt
windows7-x64
1Neptune-ma...al.txt
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
Neptune-main.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Neptune-main.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Neptune-main/README.md
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Neptune-main/README.md
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Neptune-main/config/nothing to see here
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Neptune-main/config/nothing to see here
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Neptune-main/neptune.py
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Neptune-main/neptune.py
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
Neptune-main/requirements.txt
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Neptune-main/requirements.txt
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
Neptune-main/setup.bat
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Neptune-main/setup.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Neptune-main/tutorial.txt
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Neptune-main/tutorial.txt
Resource
win10v2004-20231215-en
General
-
Target
Neptune-main/neptune.py
-
Size
41B
-
MD5
5d2e6ded09185d75b82f0914d5a5ddd4
-
SHA1
4ab3cd2d43c16b98b056a22a9cc0f5c070c6bf45
-
SHA256
7d869545d02a9b112199d9f14b8dbdad65bb2e315f8e0f4cb4b8f68084cc2fc0
-
SHA512
583293d9469394d410d9a46db43c5328f340c07400e85dcfd3c8de03434789cb4c8e755b52b2e6e95f2eaee9083be6d7f06175cac831e6f1128a127ec279b8ef
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2728 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2728 AcroRd32.exe 2728 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2044 3044 cmd.exe 29 PID 3044 wrote to memory of 2044 3044 cmd.exe 29 PID 3044 wrote to memory of 2044 3044 cmd.exe 29 PID 2044 wrote to memory of 2728 2044 rundll32.exe 30 PID 2044 wrote to memory of 2728 2044 rundll32.exe 30 PID 2044 wrote to memory of 2728 2044 rundll32.exe 30 PID 2044 wrote to memory of 2728 2044 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Neptune-main\neptune.py1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Neptune-main\neptune.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Neptune-main\neptune.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57e7059b32e0e09ba3d98f466406dea72
SHA1a2cc2998db02f3618134be8ac1ff47c82ed95494
SHA25684aa72d2549de034c56b193b1af1de524904ce41f697b36148ceb346be83c7b2
SHA51281bbc5361939e1f9256b0d75870eeb1d5d316e8aabe2b2370fd256fd1d13431ab7a3365cf7471b7588d1b6998d2c9a1fdd9184c381ad65b59eab81dcfaedef3d