Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    60s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-it
  • resource tags

    arch:x64arch:x86image:win11-20241007-itlocale:it-itos:windows11-21h2-x64systemwindows
  • submitted
    04/12/2024, 13:10

General

  • Target

    101580F357D05A637F15EEAB3A11C713A7E19D223209B443CE5D4E62346E2869.exe

  • Size

    339KB

  • MD5

    0f180f02493efbe8cd819fd0fb1ee77f

  • SHA1

    7f782ab25143951dab6b8fe17682633d42bca6da

  • SHA256

    101580f357d05a637f15eeab3a11c713a7e19d223209b443ce5d4e62346e2869

  • SHA512

    bab000b0b136a8b837e2b4ef7d57e937e9139669ed117e7c9a273fa28a484d2bf88085739c1a32f8c0be9ffee3c46b719ef3e41e869a81774f78d374d1017cf0

  • SSDEEP

    1536:JxqjQ+P04wsmJCFFHrVKZUmQoRodBOv8pVfnBnPC1N0VkiSXI0069F4TpZRgP7Z2:sr85CHMZ8fnBgWa6vTpZRyt9OvX

Malware Config

Signatures

  • Detect Neshta payload 5 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\101580F357D05A637F15EEAB3A11C713A7E19D223209B443CE5D4E62346E2869.exe
    "C:\Users\Admin\AppData\Local\Temp\101580F357D05A637F15EEAB3A11C713A7E19D223209B443CE5D4E62346E2869.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Users\Admin\AppData\Local\Temp\3582-490\101580F357D05A637F15EEAB3A11C713A7E19D223209B443CE5D4E62346E2869.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\101580F357D05A637F15EEAB3A11C713A7E19D223209B443CE5D4E62346E2869.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3268
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1944
  • C:\Windows\system32\BackgroundTransferHost.exe
    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
    1⤵
    • Modifies registry class
    PID:3968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\1eb68705-63a5-4b77-b159-5d3301e7f8a9.down_data

    Filesize

    121KB

    MD5

    c2c241c1111d82bf82a4b92f3313d801

    SHA1

    f822956f60c463000e5aaaeccf8b99f551179250

    SHA256

    2081dc0f876ba518493f98bc18988ebe6cc6c23d9d963b5c4bb5c9ecef1f9f29

    SHA512

    04f745fa497c8115bb76b42bac6e03b7a0edd394f1c4a62f329015c545bba1bc9b517b7941806bcd23e84bcd289316649c1cbd9c6804cc83dce62dc26655cd7f

  • C:\Users\Admin\AppData\Local\Temp\3582-490\101580F357D05A637F15EEAB3A11C713A7E19D223209B443CE5D4E62346E2869.exe

    Filesize

    299KB

    MD5

    4c9248a3cf76fa03af22650b38e78e4e

    SHA1

    670831b819a7b96be676806b00463e33f9404e1f

    SHA256

    e42a7f8cc24b28edb9627a3cdfd8ab3b3e0082c4d02ba93e4e57df47e20b652a

    SHA512

    ccac8c2cfd5ea39e4af57fcc9d0b4b69724cb6fbc790e41f358eff6cbfe4793972a62c8b256aca6b6f6e3c7014256c1dc43cf6e872e7f261ddd7f2517aaef71d

  • memory/4360-117-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4360-118-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4360-119-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4360-121-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB