neshta | b0bd95ea0aa5de9849e555fc8a62f51e1406c6b4dc890ce9a63c9807184d9f0b

General

Target

Quote.png.scr
Size

528KB
MD5

06b4fd7c3d1966efe2747227379e2649
SHA1

6d1f81c6b8041395342e53476247109a3ca3f433
SHA256

b0bd95ea0aa5de9849e555fc8a62f51e1406c6b4dc890ce9a63c9807184d9f0b
SHA512

8c74a3ee29ca9c8c14871be2035c56a397bc81b1a022595fea3e102d5df9243c30e0ad59b7865bd66b3e413c80246493a2a43c6655085f8bb4b9f21f9ff9f8c0

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Detect Neshta Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3240-122-0x00000000004080E4-mapping.dmp	family_neshta
behavioral2/memory/3240-121-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3240-126-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1042

Processes:

MSBuild.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" MSBuild.exe
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Suspicious use of SetThreadContext 1 IoCs

Processes:

Quote.png.scr

description pid process target process

PID 2704 set thread context of 3240 2704 Quote.png.scr MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	MSBuild.exe

description	pid	process	target process
PID 2704 set thread context of 3240	2704	Quote.png.scr	MSBuild.exe

Drops file in Program Files directory 53 IoCs

Processes:

MSBuild.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	MSBuild.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	MSBuild.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	MSBuild.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	MSBuild.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	MSBuild.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	MSBuild.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

MSBuild.exe

description ioc process

File opened for modification C:\Windows\svchost.com MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3376 schtasks.exe
Modifies registry class 1 IoCs

Processes:

MSBuild.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" MSBuild.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

508 powershell.exe
508 powershell.exe
508 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 508 powershell.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	MSBuild.exe

pid	process
3376	schtasks.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	MSBuild.exe

pid	process
508	powershell.exe
508	powershell.exe
508	powershell.exe

description	pid	process
Token: SeDebugPrivilege	508	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Quote.png.scr

description	pid	process	target process
PID 2704 wrote to memory of 508	2704	Quote.png.scr	powershell.exe
PID 2704 wrote to memory of 508	2704	Quote.png.scr	powershell.exe
PID 2704 wrote to memory of 508	2704	Quote.png.scr	powershell.exe
PID 2704 wrote to memory of 3376	2704	Quote.png.scr	schtasks.exe
PID 2704 wrote to memory of 3376	2704	Quote.png.scr	schtasks.exe
PID 2704 wrote to memory of 3376	2704	Quote.png.scr	schtasks.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe
PID 2704 wrote to memory of 3240	2704	Quote.png.scr	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Quote.png.scr
"C:\Users\Admin\AppData\Local\Temp\Quote.png.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jraYoU.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jraYoU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53E8.tmp"
2⤵
- Creates scheduled task(s)
PID:3376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
2⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Change Default File Association

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp53E8.tmp
MD5
23c1df80b4601659624c40bfaad11857

SHA1
e30a433b1035754e5c3a276299c99a1fd39f2d3f

SHA256
3d086f344eaaeb057d858e2e9e3e826cc1445f7b638ffe449397b50509df7935

SHA512
9fcfb8fb79349d57ffcb2b3c2a406cf90b6804c94d08301c4673b82aa7cfb4fc92aa3bf8e787220765182f49a29a8a8600424c82f5257218bb871f1192d7d64d

Download Submit
C:\Users\Admin\AppData\Roaming\jraYoU.exe
MD5
06b4fd7c3d1966efe2747227379e2649

SHA1
6d1f81c6b8041395342e53476247109a3ca3f433

SHA256
b0bd95ea0aa5de9849e555fc8a62f51e1406c6b4dc890ce9a63c9807184d9f0b

SHA512
8c74a3ee29ca9c8c14871be2035c56a397bc81b1a022595fea3e102d5df9243c30e0ad59b7865bd66b3e413c80246493a2a43c6655085f8bb4b9f21f9ff9f8c0

Download Submit
memory/508-142-0x0000000009470000-0x00000000094A3000-memory.dmp

Filesize
204KB

Download
memory/508-118-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/508-130-0x0000000008030000-0x0000000008031000-memory.dmp

Filesize
4KB

Download
memory/508-131-0x00000000080A0000-0x00000000080A1000-memory.dmp

Filesize
4KB

Download
memory/508-129-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/508-224-0x0000000004C93000-0x0000000004C94000-memory.dmp

Filesize
4KB

Download
memory/508-123-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/508-124-0x0000000007670000-0x0000000007671000-memory.dmp

Filesize
4KB

Download
memory/508-125-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/508-156-0x0000000009960000-0x0000000009961000-memory.dmp

Filesize
4KB

Download
memory/508-127-0x0000000004C92000-0x0000000004C93000-memory.dmp

Filesize
4KB

Download
memory/508-128-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/508-116-0x0000000000000000-mapping.dmp

Download
memory/508-119-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/508-155-0x000000007F020000-0x000000007F021000-memory.dmp

Filesize
4KB

Download
memory/508-132-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/508-133-0x0000000008730000-0x0000000008731000-memory.dmp

Filesize
4KB

Download
memory/508-134-0x0000000008780000-0x0000000008781000-memory.dmp

Filesize
4KB

Download
memory/508-135-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/508-154-0x00000000095A0000-0x00000000095A1000-memory.dmp

Filesize
4KB

Download
memory/508-149-0x0000000009410000-0x0000000009411000-memory.dmp

Filesize
4KB

Download
memory/2704-115-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/3240-126-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3240-121-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3240-122-0x00000000004080E4-mapping.dmp

Download
memory/3376-117-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads