Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c0e42cf18b138205a171768f3dddf0e0
-
Size
616KB
-
Sample
240311-se25zahg95
-
MD5
c0e42cf18b138205a171768f3dddf0e0
-
SHA1
867ebc0dae6437916f8882192652b58986d75d3c
-
SHA256
3ff5b8d4a80c9f631c2220c3f7ff9f1839bbd04d6eda9e57add7360a71774d1d
-
SHA512
887bdf246e507dbfd428916489016a6a470c668be44bc981469a89dee038179a9da67601b5dc9a1e96f8d57702abc5daa43c0f66e6f05573a3f17e49aadbc8ae
-
SSDEEP
12288:s7uII7WPIHFZQWoW1lADk6rOkEx5o7pKyskZWNCGNF+0W5iiUF:su78mZncDkYC5up6kENFfE5iiw
Behavioral task
behavioral1
Sample
c0e42cf18b138205a171768f3dddf0e0.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
c0e42cf18b138205a171768f3dddf0e0
-
Size
616KB
-
MD5
c0e42cf18b138205a171768f3dddf0e0
-
SHA1
867ebc0dae6437916f8882192652b58986d75d3c
-
SHA256
3ff5b8d4a80c9f631c2220c3f7ff9f1839bbd04d6eda9e57add7360a71774d1d
-
SHA512
887bdf246e507dbfd428916489016a6a470c668be44bc981469a89dee038179a9da67601b5dc9a1e96f8d57702abc5daa43c0f66e6f05573a3f17e49aadbc8ae
-
SSDEEP
12288:s7uII7WPIHFZQWoW1lADk6rOkEx5o7pKyskZWNCGNF+0W5iiUF:su78mZncDkYC5up6kENFfE5iiw
-
Detect Neshta payload
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1