Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-01-17...ta.exe

windows7-x64

10

2025-01-17...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 13:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe

  • Size

    226KB

  • MD5

    2cc214c8c2ad42388b5dff8bc6242012

  • SHA1

    174f80f3deefc0da870f5b54d6a2495f83d755f4

  • SHA256

    3526381b95e916f2272049bdd849089e544231310671ce51b48dda0184a53df1

  • SHA512

    33835742ff31d5fcb251abb701c0b08e21b72ab7ed72e53275361fc13dacf5aa1376b3c3873b92e53d1d8aca355f6eb29b10623a3320568c5caf715bc69478b8

  • SSDEEP

    3072:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYVqJogYg:k9Dc4m9tDm7myGq2Vq2g

Score
10/10
lockbitneshtadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 3 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x14c
    1⤵
      PID:2520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini
      Filesize

      129B

      MD5

      eb7f3a291f9986c6c685bafb878c4e94

      SHA1

      dcb83289af78cd94e80b7e350150b65a197882e6

      SHA256

      9969d3c440114e55002e28dd179174e3777d1dab166ed94cb4908406081be5d2

      SHA512

      e7f0afc69c8d4b8b4d650f57bb0367c6b46ccee14b510438c96cc6f36724fcb5d178e1d8a7d93e7cd48330405a7ad4fed98963c98af24db3a4047a16b4e3c06f

      Download Submit

    • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
      Filesize

      547KB

      MD5

      cf6c595d3e5e9667667af096762fd9c4

      SHA1

      9bb44da8d7f6457099cb56e4f7d1026963dce7ce

      SHA256

      593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

      SHA512

      ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

      Download Submit

    • C:\dfsQPArFx.README.txt
      Filesize

      423B

      MD5

      417638d64b336ac000725d893fe09af2

      SHA1

      3087de5e56c5355c9b4e8747c40ebdd54306f93b

      SHA256

      f54061329fde2ab0a09662beb97ada1c59f4d702f6e0cb4d1284b8d7a6c1dc36

      SHA512

      42d07c8d1b58283a2e5d9416a2fc495859561ced6cc6d53a0c06d01cf9e88234631391074a118d6d8d7aafe75156976cf507b83d1c5e3f6be6e01ed94641d9d5

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      f41a0593d3aad9730d257ed31fd661b9

      SHA1

      8b77c2fe11b0d5001ab1a539de2f7fe66c6063d5

      SHA256

      30ea402b1938f0b9e2018d4024b24cf5badc2d0bd7817733fc7f7a511f1a08ca

      SHA512

      14a11fd0d081922a14fde83782052b0b96c321108580bd8ef5b9313a1ed59640862927b3803f6d58a5d17c79edd4ba055f21fc1d8fa708496a5757cb9f791880

      Download Submit

    • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
      Filesize

      252KB

      MD5

      9e2b9928c89a9d0da1d3e8f4bd96afa7

      SHA1

      ec66cda99f44b62470c6930e5afda061579cde35

      SHA256

      8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

      SHA512

      2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

      Download Submit

    • \Users\Admin\AppData\Local\Temp\3582-490\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe
      Filesize

      186KB

      MD5

      149be3aa2b3b6c5f3cb980cca9e5b53a

      SHA1

      ac52b531b8aa82222f7f27ea9cc7a080e3ecc4d3

      SHA256

      f124c47e8176c4c1132a6df2889a046b4da58facf8cc10c3a1b2e296e25709cc

      SHA512

      e323b97da90389670f2e305e8cbddc4a0a228285cf1ee1f3e728de03f2042b7dc1956638734a59525322d7db82f08f7fd02ab977319c70585aeb8a66fa47c532

      Download Submit

    • memory/2120-972-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/2120-974-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/3004-14-0x00000000004D0000-0x0000000000510000-memory.dmp

      Filesize

      256KB

      Download