Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 07:10

General

  • Target

    479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe

  • Size

    5.0MB

  • MD5

    b74f46a001bfb75968c56cc26a3eb4f0

  • SHA1

    a52af299b5ff6557aec692f7fa636717eccc7aba

  • SHA256

    479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0c

  • SHA512

    8baac2be0a700ca57c68c52fa0f2a438baa058676490d1dabf39c1a2ea4269ba2f11ef9601a099b0ba007f0bcab964eff86f747bdfdfe31c2e6b2fb75d140b37

  • SSDEEP

    98304:ssDtGs0KZPPI3aaP8XEu49+20cu1HSSlZuJXtLYCq:sTsxPPe761h1HSSfuvLYCq

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Neshta family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 20 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe
    "C:\Users\Admin\AppData\Local\Temp\479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Local\Temp\3582-490\479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\installer.exe
        C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\installer.exe "--distrib-name=C:\Users\Admin\AppData\Local\Temp\3582-490\479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

    Filesize

    2.4MB

    MD5

    d9e8a1fa55faebd36ed2342fedefbedd

    SHA1

    c25cc7f0035488de9c5df0121a09b5100e1c28e9

    SHA256

    bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a

    SHA512

    134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33

  • C:\Users\Admin\AppData\Local\Temp\3582-490\479d258076fb2a010c20ce8427a3c0b14f0f43f160fb190af952b4983ed0ed0cN.exe

    Filesize

    5.0MB

    MD5

    12b095f2584aafe7b7b94096993fc548

    SHA1

    befc923ab49ebb1cf9c6ccd0b9bbcd3e921826e5

    SHA256

    0577ae39dd5b42ce566b44590fbb0b2ddc381959e94f41c9df865479e56ba23c

    SHA512

    401e0775a8088437e254c1b759b75e7a6968f2e39d17e9759cccaeaa7b80d4e83c3102d5fd3d845a80ac2889009ccc0c652844bf42bb7bd6aa5d37083c948a63

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndAppLocations.dll

    Filesize

    45KB

    MD5

    c5ad200f19ab2a21cf434e62120ea7a6

    SHA1

    b3c97aec709d45def3d4efa44e213a799ad861cc

    SHA256

    48233d0513a9310ff59c35027ff1089cc532cb354a9ed55026ad16f484cc286b

    SHA512

    dfcac01d58abe630ad59eddaa115d71c530025088eae01a7b3b3711226d340cbf05cba3ab6de5185a8949000db4c60037a6cb4694ad35a0bf89a992905f05530

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndCrashHandler.dll

    Filesize

    679KB

    MD5

    d9425df7b3e6b72a368f1f584361572c

    SHA1

    9c3bf7052bbb29124ba34ae45c490e7953bb36cf

    SHA256

    2d98e9b540fa387042a1db53bd1213b9ea2b8766df28a4c5ff232bc0f67a4c66

    SHA512

    7798581d52455b71eda970742f2e889000f1f68b274446e4825600f646d9ccb5bfce28e490171affbe154642e06e80a8998ca3140c98763b4bae0b6322fd581e

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndException.dll

    Filesize

    107KB

    MD5

    8778baab127588fcecc4af9d39f728d5

    SHA1

    59325dd41a6e69eb09a449da43c41107f8e21a39

    SHA256

    8be3c4e8749cea38916c62c3891f4b5163b0ac50511f4da9553f34e98b5a8c2b

    SHA512

    62353d4619013df60c9b4aaf24c7b41b01d9b43b65470fe19cdb1c60f5b0c83c56a187984a333a881ba02a92fb73714d60c88156231320a1e9f09b5d0af7b4bf

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndFilesystem.dll

    Filesize

    291KB

    MD5

    49b968359a2bf9e9218c9e4d893746ce

    SHA1

    180a5c2af8b172262eb9c0d76fef5b1e0463de48

    SHA256

    6b197dc24f9d04dbaf759b2b7773e279809124cd858b7591b6400ab87e9e6680

    SHA512

    46c35262839d8b3c22452ca4d2d4628d42541c84a20bc588491cd267fc7e0c0cb741f1590e959a1fdfbeb194f545779fb8548a79b24e63abba18ab0bc262b509

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndHash.dll

    Filesize

    90KB

    MD5

    cadb66ff6ddaed6637cefc158a7d4402

    SHA1

    12de197fc1858b7a15bd2e48f0cf31b4aa4b9e33

    SHA256

    97618f0a5579816d832fb884c3dbf5d8e51edc85cdf650e8f67e0a3eeac19135

    SHA512

    34552691adc316e364a42f44e3a7a8057d29d796e448c401a97f81cc48eb2902e6e5fc4d7db6bcb9f8e052998896fda499c78c981664515268aef2975560e16c

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndNetworking.dll

    Filesize

    4.0MB

    MD5

    d3639ac30a63388a1227f5f87dad1090

    SHA1

    cffaa662d5016196bf30c8d880de8778ca3fd11f

    SHA256

    e7533f692373aa35e91d88096b910b555c48fecf8bf4d2eb824dc7451fcb743e

    SHA512

    b173f1620bf64904c14ff27fb44984f8a7897e420b172204da5dd77b43bed056574d97d598fc6eb1b03ae3b5036558fa7a2760258c3f18128f990c4b1e9cb641

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndOS.dll

    Filesize

    179KB

    MD5

    cdcd616f4fe834ebae4a54e672fbf4ea

    SHA1

    7272ff408317e73a682214d09365ea0df978a426

    SHA256

    9b5f0ce2c98f25151f6be893a0e0306f1918e01b166b39093737733678fe1274

    SHA512

    7771462b3e7a864682854ac959d20907c72e090b21caeef60ee20b099a0860bad0bbfa7b4bd4fa3fcdc59111fea742031eb5611af36de7859a273cc69f82ac21

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndPointer.dll

    Filesize

    24KB

    MD5

    5a6d98a0f4339eadd0cbac2e101d142f

    SHA1

    a121d7e5e1489fb61847975ce6e2e2b3462c5414

    SHA256

    023278556de0a771c673fd2bfc1138c5b62c7f4af7b19ba412216d2776f2df39

    SHA512

    76b725f222a33316508abf21de1c0c09a8c8b18d4224a975571357668fbac7c15919f8c12b25f84b191d678d4788bad6972ae5aab4e223c07c06a9f29c13037b

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndString.dll

    Filesize

    43KB

    MD5

    54b8d930d32b12aeb16edc20271df4a6

    SHA1

    7a470484ba4fb178c81712861de6101dd9dd700b

    SHA256

    d5d96665152c0e603c4f54629f5bd3521544f3b9efd3ebc44044ff46fea2ebfb

    SHA512

    333ade8ec554db780d1b2811c442da19e3b338b491503410ef6fff487eda5309ebb95f64fc869c79dec2ce4e7fbfe7c285dac387372e16f0d69f3ee3b2bf4100

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndTime.dll

    Filesize

    63KB

    MD5

    48e4e8d99323297ea936181f6024b1e5

    SHA1

    6912e04332b9014857585c49ebe094301fc87b98

    SHA256

    78da2b0ac5048c4261dec9944e97edbb708ec53dd8035cbb464f3579aa8bcf31

    SHA512

    499904b749aefa470a3abfd4ca76db161c2942f875e9908ed2f129ef6ffbf144da2632b8273d2c4bf3bbcb55a60ed5a3cbe033e3f356d950e1b2f67b5117c5fc

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\FndVersion.dll

    Filesize

    66KB

    MD5

    40ead481b7823831073c921f8fd2f483

    SHA1

    c1ef6a734631082ada58e4b1e8e9eb4a6b63145f

    SHA256

    ecfda8beff9c9b608d82f24f3bf2e18f2f16e2623d09b132f9e983ea8bc55cd5

    SHA512

    04e997f99c5af02b9bbf50a48d94b18e2a4da1061389cc6c8508c13e3df516dd2d995f6cd42fdace9d79c644f4e365f815117530ed168f5c5a37c157442601f9

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\WebUid.dll

    Filesize

    3.5MB

    MD5

    9f7812617c11e650247aa0c4a1411bde

    SHA1

    d82ba9d8dbd3dee11e82c9a4e8ff8b746be66780

    SHA256

    70cfc3b5165f2ad83a88642098b6f79041bded4b8f91f275bfeb662b70c25d7e

    SHA512

    ba9088fa1c923e3999cf113e35791d717635649d250c7148b0928867b188c6e311af8b24bb7ef9910e51a744fc4f711e994e632cd8c090b7432ff4b9e7f7d3c4

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\boost_filesystem-mt-x64.dll

    Filesize

    149KB

    MD5

    fc840359a9d79299885707c02d78cc10

    SHA1

    25b12470db84e11ee26561129ff31a93850833cb

    SHA256

    3c4f0f03c5840ad1be8484bd1575ebae789ee90ccab79b04135ce29f76f38908

    SHA512

    7224fee7a1e83bed56765b29e4b7b1a5d5187d9dc2fa50ee8944f2bdbc618162054dc7d629b64ccb6f1978fe3d54cf8d51ccad4828034de78040571c7e63af94

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\cpr.dll

    Filesize

    3.0MB

    MD5

    be7384f443dce14cd2d78acf137dc0e2

    SHA1

    9f2f9003821135a0a92d1560ee4d9dff96eda2cf

    SHA256

    801b0c54a59ebd00c7488017a68cea95a5817f7af69b15290abeb11531a63aab

    SHA512

    3993b232f81703cf00219d7920525ce341e9250e5d67cbc7f2ffa47ef748c4b4b976c60c4ae82bd38e2d94c3d656dcb91bb80ee8e8ffb878a28fc9e890b0717a

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\glog.dll

    Filesize

    135KB

    MD5

    6a88302ca04c8f1ae0741b91284e9d64

    SHA1

    95fa0166805a68c9a285c053b830de4d5bf7c664

    SHA256

    1677b6ec1c011078fe8df03dd929366fa8c4a34df0d4bd2f8d287295e0c971ee

    SHA512

    5ab3450f95abf79667f014d96f8c679da786f4ee6a4a4811d64063e67ecedd68883996e1f3c5f34f7d0aaa6c383d868574b205396501096d1931fa6726420ba8

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\installer.exe

    Filesize

    5.2MB

    MD5

    35d14c5bf6ce4d836769bffc5e00122b

    SHA1

    5cf68c3182a71c7d35418ba0d9442b327641dd93

    SHA256

    02eec46b5bbb3d467afddda37258ac9d35e1cc1ce1a5cdd7a0d7f2becaf0cd5e

    SHA512

    8d4b02f2a3038c95bc7fb520149b10eb86028206237ca37f38c1405266bb88288bb69ceb0a4cfe083c43abb8d492ee77779cae1c35a58150d28f90db356ed0b7

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\msvcp140.dll

    Filesize

    552KB

    MD5

    29c6c243cfb1cec96b4a1008274f9600

    SHA1

    c54b10ef6305cc3814c68e6c8fd6daecbb27622a

    SHA256

    44a5af24f8d5f9c50a9e5a200a0486100afb6a0e86377e2e3e622a7bbb57cb04

    SHA512

    39c34554ea7b6d433c2aecfdeff87959e625e943bf7a446ebca8e5878eaf24198c1b188359a0343fb78478f2bc8b986ca4d0e69d39bac6ff80cb901fe4f113ee

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\vcruntime140.dll

    Filesize

    94KB

    MD5

    02794a29811ba0a78e9687a0010c37ce

    SHA1

    97b5701d18bd5e25537851614099e2ffce25d6d8

    SHA256

    1729421a22585823493d5a125cd43a470889b952a2422f48a7bc8193f5c23b0f

    SHA512

    caf2a478e9c78c8e93dd2288ed98a9261fcf2b7e807df84f2e4d76f8130c2e503eb2470c947a678ac63e59d7d54f74e80e743d635428aa874ec2d06df68d0272

  • C:\Users\Admin\AppData\Local\Temp\Movavi-installer-c0904ede-dac4-406f-859d-5777822d4a1c\vcruntime140_1.dll

    Filesize

    36KB

    MD5

    d8d1a08176ba2542c58669c1c04da1b7

    SHA1

    e0d0059baf23fb5e1d2dadedc12e2f53c930256d

    SHA256

    26c29d01df73a8e35d32e430c892d925abb6e4ad62d3630ae42b69daacba1a0d

    SHA512

    5308790fbcf6348e87e7d5b9235ed66942527326f7ba556c910d68d94617bdd247a4ed540b4b9f8d4e73d15cf4a7204c0a57d4fd348ec26e53f39b91be8617fb

  • memory/2876-264-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2876-265-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2876-267-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB