Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    85s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/08/2024, 20:28

General

  • Target

    pirate.exe

  • Size

    162KB

  • MD5

    b87762a9c86a8b5c980927fedeec7d63

  • SHA1

    932313dad18a36174088000c4edb7205ebd98e57

  • SHA256

    ae96775bcf6bb177ce73153f518676e62519f66bea9a82450ad2eda5924c5205

  • SHA512

    185bd2720ac350fbac6eae00f6aa9f84bc0fb1541eec00a73fe872c372875049fbab331011ee79978d8db0f028fbaf40b2d1c676171f6fca3fde09fa5d28031e

  • SSDEEP

    3072:sr85CMdz5RI4QchImNtZDBk+R7RV8oI0oR4K:k9YQRmBd7MoITV

Malware Config

Signatures

  • Detect Neshta payload 32 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pirate.exe
    "C:\Users\Admin\AppData\Local\Temp\pirate.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\3582-490\pirate.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\pirate.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:3824
  • C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Windows\System32\GamePanel.exe" 000000000013007C /startuptips
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\SysWOW64\GamePanel.exe
      C:\Windows\System32\GamePanel.exe 000000000013007C /startuptips
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3600
  • C:\Windows\System32\bcastdvr.exe
    "C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
    1⤵
    • Drops desktop.ini file(s)
    PID:348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

    Filesize

    9.4MB

    MD5

    58f9bc16408d4db56519691315bb8a75

    SHA1

    ac94543044371e3ea49918eb0f114a29ab303004

    SHA256

    5562973f2b3aa9d0c6184143360f7861b4129605f5e63b896ad815f381e6475b

    SHA512

    e1884456f86bb7cf7d268942f6fc1bacaa550eac31aaf186d9e95c15bdc41d05638cfdea1762c92681225af72008d251b101e8f291e3a74f382832336b82d39d

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

    Filesize

    183KB

    MD5

    9dfcdd1ab508b26917bb2461488d8605

    SHA1

    4ba6342bcf4942ade05fb12db83da89dc8c56a21

    SHA256

    ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5

    SHA512

    1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

    Filesize

    131KB

    MD5

    5791075058b526842f4601c46abd59f5

    SHA1

    b2748f7542e2eebcd0353c3720d92bbffad8678f

    SHA256

    5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

    SHA512

    83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

    Filesize

    254KB

    MD5

    4ddc609ae13a777493f3eeda70a81d40

    SHA1

    8957c390f9b2c136d37190e32bccae3ae671c80a

    SHA256

    16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950

    SHA512

    9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

    Filesize

    278KB

    MD5

    12c29dd57aa69f45ddd2e47620e0a8d9

    SHA1

    ba297aa3fe237ca916257bc46370b360a2db2223

    SHA256

    22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880

    SHA512

    255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

  • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

    Filesize

    1.2MB

    MD5

    8e42f3a4a399d84e67ed633ba23863cb

    SHA1

    02ebfa5274214dcc48acfd24b8da3fb5cb93f6c6

    SHA256

    42716ea8beca9e555cef3b78a2fbf836c9da034318d625262810290309d955db

    SHA512

    0f6af721a89c2cf7249ecb1cc0a263c6252f8762b7381b35ccff6347d7d069799d2f0561bec0a651d690fbf29c98050bf15b604d3cca668b7437503ba102492f

  • C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe

    Filesize

    366KB

    MD5

    927c75ca98552179273baebb2038b44e

    SHA1

    e85f3a6b2f25c344a76306579a488ee3a757a1cf

    SHA256

    625a894f316118bcb6b291fcfe0d35b3bf0204285999885eb5b489bf1bd8581f

    SHA512

    55b0498c69568b3ef45a5ea22dbccb582b45e969678339b66264ab2186416ff373a3cef4c13b4ec06fe18dca575e7d54ba20a0645c3c54816882fd3d51c48bfc

  • C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe

    Filesize

    546KB

    MD5

    10748253009c18f4695b7043dcf36fdc

    SHA1

    22d24c7b4cd0b280f09a76534545cfdc1d66a256

    SHA256

    3bee29dd355e50cdf24736a2a53d8fffd9cd93e702109f20d65a7e2e2fcfd9f1

    SHA512

    477462d114a9aac7aead3483a5a038f1fc4484514c2aa0a4c6d6aab30075056ad439592b1f9a72cf4c4499eefa8aeb744e0c2dad439ef8efae795611df352080

  • C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe

    Filesize

    366KB

    MD5

    d722ea08b4e55dbfca956d34b7fef6e2

    SHA1

    69119f4475fc6f7fd1f749c52b03cc49adf50014

    SHA256

    9fc432a9ce058ba19348e5918a716db8d429cfd87ae51deccc220ff5d2a9708c

    SHA512

    11bc7e857aeabbc3c914da0d00cdc34fe3cd42ebea22a3c688985dda1b94095ba634a3bc1c9d1e0a808f8be42f1d754233ab963d123329066b9e0cb6f3c3719a

  • C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE

    Filesize

    155KB

    MD5

    96a14f39834c93363eebf40ae941242c

    SHA1

    5a3a676403d4e6ad0a51d0f0e2bbdd636ae5d6fc

    SHA256

    8ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a

    SHA512

    fbf307a8053e9478a52cfdf8e8bad3d7c6664c893458786ae6ee4fffc6fe93006e99a2a60c97fb62dad1addd5247621517f4edee5d9545717c4587a272cef9a2

  • C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE

    Filesize

    230KB

    MD5

    e5589ec1e4edb74cc7facdaac2acabfd

    SHA1

    9b12220318e848ed87bb7604d6f6f5df5dbc6b3f

    SHA256

    6ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67

    SHA512

    f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a

  • C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE

    Filesize

    155KB

    MD5

    f7c714dbf8e08ca2ed1a2bfb8ca97668

    SHA1

    cc78bf232157f98b68b8d81327f9f826dabb18ab

    SHA256

    fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899

    SHA512

    28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

  • C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE

    Filesize

    265KB

    MD5

    25e165d6a9c6c0c77ee1f94c9e58754b

    SHA1

    9b614c1280c75d058508bba2a468f376444b10c1

    SHA256

    8bbe59987228dd9ab297f9ea34143ea1e926bfb19f3d81c2904ab877f31e1217

    SHA512

    7d55c7d86ccabb6e9769ebca44764f4d89e221d5756e5c5d211e52c271e3ce222df90bc9938248e2e210d6695f30f6280d929d19ef41c09d3ea31688ae24d4bf

  • C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE

    Filesize

    342KB

    MD5

    5da33a7b7941c4e76208ee7cddec8e0b

    SHA1

    cdd2e7b9b0e4be68417d4618e20a8283887c489c

    SHA256

    531e735e4e8940dfe21e30be0d4179ceaecb57ce431cf63c5044e07048ac1751

    SHA512

    977aeecfbc693c9d5746fedf08b99e0b0f6fd7b0c7b41ac2b34a832e68a2e6f3c68f38af2e65c87075fcf00c1c6103e34324df45d7da9412cbbeea7e410794b6

  • C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE

    Filesize

    439KB

    MD5

    400836f307cf7dbfb469cefd3b0391e7

    SHA1

    7af3cbb12d3b2d8b5d9553c687c6129d1dd90a10

    SHA256

    cb5c5abb625a812d47007c75e3855be3f29da527a41cf03730ad5c81f3eb629a

    SHA512

    aa53cb304478585d6f83b19a6de4a7938ba2570d380a565a56ff5365aed073d5f56b95ad3228eb7d1e7e6110c6172a58b97bd6a5e57e4a8d39e762ed31dc17c8

  • C:\PROGRA~2\Google\Update\DISABL~1.EXE

    Filesize

    207KB

    MD5

    3b0e91f9bb6c1f38f7b058c91300e582

    SHA1

    6e2e650941b1a96bb0bb19ff26a5d304bb09df5f

    SHA256

    57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d

    SHA512

    a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

  • C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE

    Filesize

    267KB

    MD5

    15163eb05b0a8f65a5ca3c74a658077d

    SHA1

    8b116062a5754fa2d73fc4df9f635283ae1ccd02

    SHA256

    8751c43ee0f3f0e080103a9b77be9e79346004769ed43d4cadd630ea15d26dcf

    SHA512

    a8299e9a522aa58429847920b999598551c1863f63ba473178f61cde43fb91cab6ef62c9e1a51268e54338e012ccfe6428a7c37bc89007d1604fafa2560258c9

  • C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

    Filesize

    141KB

    MD5

    7e3b8ddfa6bd68ca8f557254c3188aea

    SHA1

    bafaaaa987c86048b0cf0153e1147e1bbad39b0c

    SHA256

    8270ecef6079a21f5ae22f1a473e5eb8abac51628367f4acf6466529ba11d7e2

    SHA512

    675ca07cdb787b3f624eae9707daf519214f8dc4670c524cef5110c9dba197e833cedb051919c757c58a3687e63cf175d1397d8ce69c5995f4eab3b85f6dafbb

  • C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe

    Filesize

    534KB

    MD5

    051978153bcd2b1cf032fa1bf5a82020

    SHA1

    ec6d1d42905a1c92ccee5f4980898d7a1d72aa23

    SHA256

    88e90f04db57a472acacf1f4e7616d05a488fc7a1b41a468b357ac4419489940

    SHA512

    68dec8a12b2c10a9ff83907705c68c77284928d9349a8ba93808d09123752b84944505208d7d71540e340dcbb06e74c79fa24748098308eeecab5f80ab4e8d15

  • C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE

    Filesize

    526KB

    MD5

    7ec5ddf3fcc6796ca4e49ba4b3cf196a

    SHA1

    0f5d6a04f70f466b3cbe1750d9be78da80579e07

    SHA256

    f71d62354d4c6eec8a9cd14db442b9a5f2a6550468b01bda06f82acaa8e0c9b8

    SHA512

    f3884675fd5d324843102bf7dcc22885962ce1feaaf9f2460af8de36d594102957da993576405f18686e04ac693b651fec22c4e66a9821329f53f712281c87ea

  • C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

    Filesize

    6.7MB

    MD5

    63dc05e27a0b43bf25f151751b481b8c

    SHA1

    b20321483dac62bce0aa0cef1d193d247747e189

    SHA256

    7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

    SHA512

    374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

  • C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

    Filesize

    674KB

    MD5

    97510a7d9bf0811a6ea89fad85a9f3f3

    SHA1

    2ac0c49b66a92789be65580a38ae9798237711db

    SHA256

    c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

    SHA512

    2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

  • C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

    Filesize

    715KB

    MD5

    06366e48936df8d5556435c9820e9990

    SHA1

    0e3ed1da26a0c96f549720684e87352f1b58ef45

    SHA256

    cd47cce50016890899413b2c3609b3b49cb1b65a4dfcaa34ece5a16d8e8f6612

    SHA512

    bea7342a6703771cb9b11cd164e9972eb981c33dcfe3e628b139f9e45cf1e24ded1c55fcdfa0697bf48772a3359a9ddd29e4bb33c796c94727afd1c4d5589ea3

  • C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

    Filesize

    495KB

    MD5

    9597098cfbc45fae685d9480d135ed13

    SHA1

    84401f03a7942a7e4fcd26e4414b227edd9b0f09

    SHA256

    45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

    SHA512

    16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

  • C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

    Filesize

    485KB

    MD5

    87f15006aea3b4433e226882a56f188d

    SHA1

    e3ad6beb8229af62b0824151dbf546c0506d4f65

    SHA256

    8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

    SHA512

    b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

  • C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

    Filesize

    536KB

    MD5

    ad7d4d593001c1be47bc030b94425db2

    SHA1

    e7a421916f2def227f7d6a516e94def7660b7d8e

    SHA256

    d092e1ed460777bc23e3bc8acea9911a53c13e3ff5735ce116ae4e793595f8a7

    SHA512

    2dbb5686a0d67f22b1ff7e9edc8694c6b6d17c0ca0f26ef7a0698a829bfcd94f5b32ededfdc5c1b53851cb30160e2ce40d11615d8a47f71c8f77e64eb8829b53

  • C:\Users\Admin\AppData\Local\Temp\3582-490\pirate.exe

    Filesize

    121KB

    MD5

    2bfcca795e14a7085534e541c6185c60

    SHA1

    604a0003caa07076533bc2f32757891a1847c43c

    SHA256

    1d2ef895bac198134dd7c81e570589520b5b3b80ea5db364fa49b4674de2c724

    SHA512

    4cd1026613b509f2649d06e94592ec103e75d2e0f208e0e43a2cdd09ab0adc5205c668c9e6b8bdee3aee1194fda6ac112f15884c592ea71b492ddf8c49af2ba5

  • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

    Filesize

    8B

    MD5

    26b81d62c76b4910850972821b58404a

    SHA1

    5d5297262061514c961f7a8669b5621f9434c5d0

    SHA256

    deab78c82a786557316ba66d004fadb8871e2d6f3c93d1637a8f0b9c310d9020

    SHA512

    0726c9482faa3a9a20e9da35e1fd89f84b4bdfd36a7861e6ea6c51265e2d70e910337baa6d44037a63f0ebbf39cc443d5a4f3691f60a38c4c735c72b3fbc42a4

  • C:\Users\Admin\Videos\Captures\desktop.ini

    Filesize

    190B

    MD5

    b0d27eaec71f1cd73b015f5ceeb15f9d

    SHA1

    62264f8b5c2f5034a1e4143df6e8c787165fbc2f

    SHA256

    86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

    SHA512

    7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

  • C:\Windows\svchost.com

    Filesize

    40KB

    MD5

    91146970087239c60d17165bacdc2e09

    SHA1

    9e5bd50f08f83b7a68ff8b30dfea7d5b178cd1d2

    SHA256

    538a2b9bbd6b746d712ee950eaed2a9a244817342dbc4763c2f045a966b4d1dd

    SHA512

    774348038565272ec523414ed97b9c3e0fa56349bf72de0e2dc24e4c0ed62ada238e8c97db8ed0b1c71930cd212f84c9e9238b34eb32a656d921ff62283ce24b

  • memory/3824-139-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/3824-6-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/3824-143-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/3824-131-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/3824-141-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

  • memory/3824-140-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/4020-132-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4020-138-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4896-137-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4896-133-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4896-130-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB