Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-01-17...ta.exe

windows7-x64

10

2025-01-17...ta.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2025, 13:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe

  • Size

    226KB

  • MD5

    2cc214c8c2ad42388b5dff8bc6242012

  • SHA1

    174f80f3deefc0da870f5b54d6a2495f83d755f4

  • SHA256

    3526381b95e916f2272049bdd849089e544231310671ce51b48dda0184a53df1

  • SHA512

    33835742ff31d5fcb251abb701c0b08e21b72ab7ed72e53275361fc13dacf5aa1376b3c3873b92e53d1d8aca355f6eb29b10623a3320568c5caf715bc69478b8

  • SSDEEP

    3072:sr85CDcSNm9V7Dm7i1j0XjuTxqJogYVqJogYg:k9Dc4m9tDm7myGq2Vq2g

Score
10/10
lockbitneshtadiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 4 IoCs
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini
    Filesize

    129B

    MD5

    2259ccc1c5f9d49e6e6fdd2ee6d4ab86

    SHA1

    6f06a9ad9bd64a942787eba9df22ae0cb8940d28

    SHA256

    e50d1af02aac4e0b645b0e50d56eee4d12f408ee740dcd10be6f5e9c27fb9977

    SHA512

    b083a0501ec916673063780ba5ac40c890da4e2d5f26f4d3f0e8799e0874768847512d249930f3c6bc80c4d88461f8a9ec20173ffd31beb2f26617880faf63e4

    Download Submit

  • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
    Filesize

    86KB

    MD5

    3b73078a714bf61d1c19ebc3afc0e454

    SHA1

    9abeabd74613a2f533e2244c9ee6f967188e4e7e

    SHA256

    ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

    SHA512

    75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\3582-490\2025-01-17_2cc214c8c2ad42388b5dff8bc6242012_darkside_neshta.exe
    Filesize

    186KB

    MD5

    149be3aa2b3b6c5f3cb980cca9e5b53a

    SHA1

    ac52b531b8aa82222f7f27ea9cc7a080e3ecc4d3

    SHA256

    f124c47e8176c4c1132a6df2889a046b4da58facf8cc10c3a1b2e296e25709cc

    SHA512

    e323b97da90389670f2e305e8cbddc4a0a228285cf1ee1f3e728de03f2042b7dc1956638734a59525322d7db82f08f7fd02ab977319c70585aeb8a66fa47c532

    Download Submit

  • C:\dfsQPArFx.README.txt
    Filesize

    423B

    MD5

    ff8ed0cea81a11c867a71d1176bc22b7

    SHA1

    f7293ddde91bdf6f57f3669f4ca612362a62523b

    SHA256

    4822870ad32cda01f6bd0139dc9b4464f1a88f54f7166d25eb75ed9a84d7cbbc

    SHA512

    51a9733f72c6e35677683008fa91deb6ecd364bac1406d9f0f52f0b0be49738ea5ddf477d914985c9d93c833156adedf4622b58ebd8ae06e6279db17716cdd94

    Download Submit

  • F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\DDDDDDDDDDD
    Filesize

    129B

    MD5

    f36676ec3af723cb372b7ca69b5b4d98

    SHA1

    f1378305fc1a9c77951bb3a0432c8478970dbe0e

    SHA256

    87392b96ab365ac9754b7278b103a57fe25627b28e5bb1f51a05d8e5f304a6ee

    SHA512

    273bda1592d559d2cc800fa5e57449a5613d23b9f1cbc1f7bba78fa0f592e8569d243a9264f5414e3ce4b3ca449e3751b0cd6fb97f5b2b217bd1e4d1ad2a06a4

    Download Submit

  • memory/2756-9-0x0000000000D90000-0x0000000000DA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2756-10-0x0000000000D90000-0x0000000000DA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2756-11-0x0000000000D90000-0x0000000000DA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4604-3043-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4604-3044-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4604-3046-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download