Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/11/2024, 17:04

General

  • Target

    HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe

  • Size

    5.6MB

  • MD5

    c258627dc4713143f84e08683d0b75d0

  • SHA1

    ce737c10059a33305ea08be0189c949d5f282c88

  • SHA256

    d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6

  • SHA512

    c3b51312fdc60579a524f6c398b1aff8c0a0dadb0ed893bb6bb6030756e7b00aa6cf7db0848fa93953ff8b1f2d1c18c5494aeaad11ce5bb5367fe7cd458a88b3

  • SSDEEP

    98304:3WpYFiMWrWb3axxkSNGFt01gP3nNqiJ+Jhki7:GpsV3axxzN806vNLQ7

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe
    "C:\Users\Admin\AppData\Local\Temp\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\3582-490\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Users\Admin\AppData\Local\Temp\3582-490\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe
        C:\Users\Admin\AppData\Local\Temp\3582-490\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=95.0.4635.88 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff72248dbf8,0x7ff72248dc08,0x7ff72248dc18
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Temp\3582-490\HashIs-d6d6f0e865aa4d08871752567f95645ddd966b1a044f048f9f6940a3560c7fd6.exe

    Filesize

    5.6MB

    MD5

    386238555736770273cc52c7b62992d1

    SHA1

    eabd86814cf03cf3a1323c58cdfba914e3505ccc

    SHA256

    16ba4e3b2788a938e2ce81b2d6aedeaf35926b1d03573bf6574423cd4d39ab85

    SHA512

    ddad84d886a803a9c978665fa126c32671719edf8504e42b8ace0b161d14d982501f8fc45490b409af548a24a54a71ed19a9b8c1394cda7c9be018c7d34afa9e

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\reports\23005f46-d5b3-44db-8f6a-eae67e060051.dmp

    Filesize

    270KB

    MD5

    8548d6edff614a97902eb05fc61371c2

    SHA1

    fbf39ca30091742f1a8d58617511e5784ad81e08

    SHA256

    8be4c8674de56a015e25b306461451dadec1cf7b5c9a058177f011833e23be12

    SHA512

    49f909071846ee06195939302960c1b076afb44191f3bf00bd66546c7a6b805fff1781d6cff3ebf9850b015cdbd095353cb5ea908287c2a436566300eaaf396d

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    6d72ba65ec4e817af0d0dbc676a0b6ac

    SHA1

    2ae3067d1acd620dcc17cbe6ca492a2117f7b67a

    SHA256

    90446e3b13d2ac030cd9b28137a63beb2c2898ec210f99f51fd90d3319e2ab71

    SHA512

    d7d4f12f1b784e797cf8cad722d5b9324115588a4104ac1f3e60f7bf9575607287131c30641cf3ba71110d3a9cb240042dc92899f231a32498756fb9bb396f9e

  • memory/4212-117-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4212-118-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4212-120-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB