Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 18:14

General

  • Target

    014af238ecbe1852afb3be6d17e53850N.exe

  • Size

    230KB

  • MD5

    014af238ecbe1852afb3be6d17e53850

  • SHA1

    765ba29937f6594d2cead7484599df52ddae32c4

  • SHA256

    673596f4f8e7bb80ffd2c01e481ac6a3f1353676740a28d5dbdfdeed9fd51e33

  • SHA512

    bab91de837e875f9365b2cc9fa8ae50e9b333ca5b55ea4cb62c7b4bcadbe9b408d96ca51f801e893f07f20535f3b4a4afefe923ebc9acf88726df8acee5ba9fe

  • SSDEEP

    3072:sr85CP8ROB/WD0vWFYeW8qURpqHzz/gZXnIVOAw085X6hFDZDWPxsSzayet+2Kf1:k9EK/2C+6s3IVOAw0XZWSSza1+DfJoI

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\014af238ecbe1852afb3be6d17e53850N.exe
    "C:\Users\Admin\AppData\Local\Temp\014af238ecbe1852afb3be6d17e53850N.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    PID:2820
    • C:\Users\Admin\AppData\Local\Temp\3582-490\014af238ecbe1852afb3be6d17e53850N.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\014af238ecbe1852afb3be6d17e53850N.exe"
      2⤵
      • Executes dropped EXE
      PID:2508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Temp\3582-490\014af238ecbe1852afb3be6d17e53850N.exe

    Filesize

    190KB

    MD5

    95a257157db2b1ffb6ea60938973309a

    SHA1

    a1221dec7d60a52b57dd382d78f59dc0e8b043d9

    SHA256

    6968bd21c94bf71483868cd6d0ddd6e540f2c795c78e17e6ad8e634c1217be7b

    SHA512

    b3695a6e4563e8b359cde9aea625f24e16ac56603a4fcc74d29efd478a8d1351498982dc048bdc790aaa45a3aa6f64ec202ff71d9380f7605f386f53d468cebe

  • memory/2820-98-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2820-99-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2820-101-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB