Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 21:35

General

  • Target

    9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

  • Size

    344KB

  • MD5

    2730ab4cf366b53d78a9d172c9b9ef5c

  • SHA1

    554ed8f8cfaf51db2a6fd6dc35dc3e5060bb5ac4

  • SHA256

    9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4

  • SHA512

    c359e054aaa52047cb81207788d72b2d93be22252f01aad260823cdb1c479021c6cf5b1a6ac6d4931286bc69166d1e88b23d51d4de93309836f73af6280d3f1b

  • SSDEEP

    6144:/9Gpcq+HpFeHPgsHsSYafq8g2OLWFTlAOBh:opcqapMvgzS/JuuAQ

Malware Config

Signatures

  • Detect Neshta payload 14 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
    "C:\Users\Admin\AppData\Local\Temp\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe"
      2⤵
      • Executes dropped EXE
      PID:2888
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1380 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

      Filesize

      2.4MB

      MD5

      cf26c2bb021e5a55c9efe85c8f71d80a

      SHA1

      596e16eaa10698c4e75681bd39b49cc566ebe124

      SHA256

      f2e502c323c8a376721ee70e5309a06dcb3f8bf6df040b9a466fd0f8c5e8600c

      SHA512

      301f12e40317b5a0159258a87774a38f0027cb868368807187500c6b2e472228deec4356d4125da89b8263a269c42cbee218e505fcd84617457d8aa47ea2a1da

    • C:\Users\Admin\AppData\Local\Temp\3582-490\9549b48cabb0f121341ed63aef89c4a09c37842de712d8711c16cc449bbe6df4.exe

      Filesize

      304KB

      MD5

      a2ff144973a98d241d129081fa9baa6b

      SHA1

      7db942775d84fe782e85390c0ddd1b1ef61617b1

      SHA256

      1cc8e44c620067448bdd2fa88f9ff3a3c64b9a3f06b51c4116ab73376a48bc0a

      SHA512

      c71abb7c0ad554d5f1a5e324163763c6ff5476d37145092c69f213973278c7899818a3809a80323184eaedcbd45f9f5a6acd73d776dc617d32ededc89f84a303

    • memory/2720-111-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-28-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-109-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-110-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-0-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-112-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-113-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-114-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-115-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-116-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-117-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-118-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2720-119-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB