Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
01-11-2021 08:53
Static task
static1
Behavioral task
behavioral1
Sample
1b04654c14fdc19c54a855598f2aec8f.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
1b04654c14fdc19c54a855598f2aec8f.exe
Resource
win10-en-20211014
General
-
Target
1b04654c14fdc19c54a855598f2aec8f.exe
-
Size
133KB
-
MD5
1b04654c14fdc19c54a855598f2aec8f
-
SHA1
d0e74542ea095620ad2c00c0027654829592aa82
-
SHA256
3584d148b7a74670cb6e633744de9b90f53ba0388ee9af369bb82503446212a7
-
SHA512
d4277601ebd28987b8e30d3cb9fe392e54d0615abd412422aaf85ceb2f1bea5ece0b3c90818d1ca9db0d30cee0a1fe8142c4f023b351b8ea72734eacacd0de83
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1b04654c14fdc19c54a855598f2aec8f.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exepid process 2760 1b04654c14fdc19c54a855598f2aec8f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 53 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 1b04654c14fdc19c54a855598f2aec8f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 1b04654c14fdc19c54a855598f2aec8f.exe -
Drops file in Windows directory 1 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exedescription ioc process File opened for modification C:\Windows\svchost.com 1b04654c14fdc19c54a855598f2aec8f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3996 2760 WerFault.exe 1b04654c14fdc19c54a855598f2aec8f.exe -
Processes:
1b04654c14fdc19c54a855598f2aec8f.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\1b04654c14fdc19c54a855598f2aec8f.exe = "11001" 1b04654c14fdc19c54a855598f2aec8f.exe -
Modifies registry class 1 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1b04654c14fdc19c54a855598f2aec8f.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
WerFault.exepid process 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2760 1b04654c14fdc19c54a855598f2aec8f.exe Token: SeDebugPrivilege 3996 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exepid process 2760 1b04654c14fdc19c54a855598f2aec8f.exe 2760 1b04654c14fdc19c54a855598f2aec8f.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
1b04654c14fdc19c54a855598f2aec8f.exedescription pid process target process PID 2740 wrote to memory of 2760 2740 1b04654c14fdc19c54a855598f2aec8f.exe 1b04654c14fdc19c54a855598f2aec8f.exe PID 2740 wrote to memory of 2760 2740 1b04654c14fdc19c54a855598f2aec8f.exe 1b04654c14fdc19c54a855598f2aec8f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b04654c14fdc19c54a855598f2aec8f.exe"C:\Users\Admin\AppData\Local\Temp\1b04654c14fdc19c54a855598f2aec8f.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\1b04654c14fdc19c54a855598f2aec8f.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\1b04654c14fdc19c54a855598f2aec8f.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2760 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2760 -s 25883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1b04654c14fdc19c54a855598f2aec8f.exeMD5
e541afcc248201b0a116b5aebc62fc61
SHA13ab266b5fa937e109343f73c202119b2f9cf1892
SHA2563260108f22616d6ba1eca12e269a664e9fc09c6d5f658de648c78d27289bc59c
SHA5128d274e35de05ba587e68b1b9f665c5e267453a775e53971d2146c251d615c8d414e77b2dbebe7a45e1a9b75a2c08a3c3be5a9e0c785529fbc82df80672605082
-
C:\Users\Admin\AppData\Local\Temp\3582-490\1b04654c14fdc19c54a855598f2aec8f.exeMD5
e541afcc248201b0a116b5aebc62fc61
SHA13ab266b5fa937e109343f73c202119b2f9cf1892
SHA2563260108f22616d6ba1eca12e269a664e9fc09c6d5f658de648c78d27289bc59c
SHA5128d274e35de05ba587e68b1b9f665c5e267453a775e53971d2146c251d615c8d414e77b2dbebe7a45e1a9b75a2c08a3c3be5a9e0c785529fbc82df80672605082
-
memory/2760-115-0x0000000000000000-mapping.dmp
-
memory/2760-118-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/2760-120-0x0000000002BB0000-0x0000000002BB2000-memory.dmpFilesize
8KB
-
memory/2760-121-0x0000000002BB3000-0x0000000002BB4000-memory.dmpFilesize
4KB
-
memory/2760-122-0x0000000002BB2000-0x0000000002BB3000-memory.dmpFilesize
4KB
-
memory/2760-123-0x0000000002BB4000-0x0000000002BB5000-memory.dmpFilesize
4KB