Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2024, 21:52

General

  • Target

    KWSuitev2.1.exe

  • Size

    1.9MB

  • MD5

    179ceae64423ec7003eb2b306b3c2171

  • SHA1

    7834ab73198780fbaf9c241914d8b9f7e0649184

  • SHA256

    326614198b1dd3ac322524f6a9eae6d77404f07fe4f455b45b5a0aea71bf860d

  • SHA512

    c09ce509654acb4f7a8df99551d1136ceffacb222fef1310eca676454c93756931f7e0b0d2c4d31349f76cecc62263076d8285f627dc416f9564e72a6f67c104

  • SSDEEP

    24576:Y2GHWoMmgHdn4MM+/OCMX+KYb06W7NS9G3yXE7SJ7BDRxpuscCTNobseacb9N/9h:Y3H9aHV9viF7NLyXE7SIsXxcz9Th

Malware Config

Signatures

  • Detect Neshta payload 5 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KWSuitev2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\KWSuitev2.1.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Users\Admin\AppData\Local\Temp\3582-490\KWSuitev2.1.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\KWSuitev2.1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Temp\3582-490\KWSuitev2.1.exe

    Filesize

    1.8MB

    MD5

    b215d7d984863693cd30d6e0c9310802

    SHA1

    3d7bbe022796afa34cf212dca9ae28e60301786f

    SHA256

    02c043c7b22cf0a298f4ba1a6ae6575ed2de506c3c881b4219d82af15317ba79

    SHA512

    b3fa8b688877ec19a7e0cf4b422582d11f7fde85482a4d2b5ce62d66ec959f08fa2bb0819ca53f8eee20d1951e3599746183275fb4b6d0c37af5ba2994afd56d

  • memory/2948-85-0x00000000733C0000-0x0000000073B70000-memory.dmp

    Filesize

    7.7MB

  • memory/2948-91-0x00000000733C0000-0x0000000073B70000-memory.dmp

    Filesize

    7.7MB

  • memory/2948-15-0x0000000004EC0000-0x0000000004FE4000-memory.dmp

    Filesize

    1.1MB

  • memory/2948-16-0x0000000005590000-0x0000000005B34000-memory.dmp

    Filesize

    5.6MB

  • memory/2948-17-0x0000000005080000-0x0000000005112000-memory.dmp

    Filesize

    584KB

  • memory/2948-18-0x0000000005120000-0x0000000005334000-memory.dmp

    Filesize

    2.1MB

  • memory/2948-19-0x0000000005070000-0x000000000507A000-memory.dmp

    Filesize

    40KB

  • memory/2948-13-0x0000000000170000-0x0000000000354000-memory.dmp

    Filesize

    1.9MB

  • memory/2948-68-0x00000000733C0000-0x0000000073B70000-memory.dmp

    Filesize

    7.7MB

  • memory/2948-107-0x0000000009ED0000-0x0000000009F36000-memory.dmp

    Filesize

    408KB

  • memory/2948-14-0x00000000733C0000-0x0000000073B70000-memory.dmp

    Filesize

    7.7MB

  • memory/2948-12-0x00000000733CE000-0x00000000733CF000-memory.dmp

    Filesize

    4KB

  • memory/2948-78-0x0000000006730000-0x00000000067E2000-memory.dmp

    Filesize

    712KB

  • memory/2948-108-0x000000000A340000-0x000000000A362000-memory.dmp

    Filesize

    136KB

  • memory/2948-109-0x000000000A370000-0x000000000A6C4000-memory.dmp

    Filesize

    3.3MB

  • memory/2948-111-0x00000000733CE000-0x00000000733CF000-memory.dmp

    Filesize

    4KB

  • memory/2948-114-0x00000000733C0000-0x0000000073B70000-memory.dmp

    Filesize

    7.7MB

  • memory/2948-116-0x00000000733C0000-0x0000000073B70000-memory.dmp

    Filesize

    7.7MB

  • memory/4996-115-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4996-117-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4996-118-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4996-120-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB