Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 21:19 UTC

General

  • Target

    33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989.exe

  • Size

    169KB

  • MD5

    a55352cc353d0b8d14e2d13ede87ec5f

  • SHA1

    6b8e1c03aff04edbae49d910d22e2c00d13cd308

  • SHA256

    33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989

  • SHA512

    cef5ebbdb4d4827202cb26b0c6d8fbcc7ad29541301f7d84d2dfacebd79812499ae68898a7e3912d20a8f8e4985385fcf8faeae1e2af2c3e27fb08380cc7c315

  • SSDEEP

    3072:sr85CQ84WdGFt/5ogrHB9FyviLd44qDXxMm2cX0mZs+05Fo51:k97dWh96QOH1/a5Fo51

Malware Config

Signatures

  • Detect Neshta payload 3 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989.exe
    "C:\Users\Admin\AppData\Local\Temp\33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\3582-490\33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989.exe"
      2⤵
      • Executes dropped EXE
      PID:580

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

    Filesize

    547KB

    MD5

    cf6c595d3e5e9667667af096762fd9c4

    SHA1

    9bb44da8d7f6457099cb56e4f7d1026963dce7ce

    SHA256

    593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

    SHA512

    ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

  • \Users\Admin\AppData\Local\Temp\3582-490\33b074528d775f34088385e730a0cdeef7118c0f0fdd5d8bf954066806b20989.exe

    Filesize

    128KB

    MD5

    d00cacde6402e97240fcf9983d16c1c1

    SHA1

    ec085677cd01e3fe7398fec4e1d3ba2d7bd96b53

    SHA256

    090622d67b74ce235631adbd7af8492aedcc6a530b10513f3a2c59d70f42d2f4

    SHA512

    1d92029aa0624018cf3165a10a49184584a907aa7390c5256e0dfc390d84259dd8dd1aed24df9c116261f37c7e622b3381758f564f883c18bf3475fb7a511324

  • memory/1268-82-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1268-84-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.