Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
17-11-2021 15:36
Static task
static1
Behavioral task
behavioral1
Sample
186ee2b0fbae609d44351da0241dd0ec.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
186ee2b0fbae609d44351da0241dd0ec.exe
Resource
win10-en-20211014
General
-
Target
186ee2b0fbae609d44351da0241dd0ec.exe
-
Size
900KB
-
MD5
186ee2b0fbae609d44351da0241dd0ec
-
SHA1
24a9e98e48c1b5a62cc01456fd7eb2d2782d4f90
-
SHA256
6315729f81fe55e4121e212fe2fb769e9cfbfba2178df45be066d5921817e371
-
SHA512
e52df0cb502fa5269c994cee6b231ab48935f68be1beed9db1b4c3a96425a7868f4d6dac6b1353d88a025992200063cc7c86ad6289939075e1b570e2cbd97b52
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 186ee2b0fbae609d44351da0241dd0ec.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Loads dropped DLL 1 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exepid process 1892 186ee2b0fbae609d44351da0241dd0ec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription pid process target process PID 972 set thread context of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe -
Drops file in Program Files directory 64 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription ioc process File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 186ee2b0fbae609d44351da0241dd0ec.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 186ee2b0fbae609d44351da0241dd0ec.exe -
Drops file in Windows directory 1 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription ioc process File opened for modification C:\Windows\svchost.com 186ee2b0fbae609d44351da0241dd0ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 186ee2b0fbae609d44351da0241dd0ec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exepid process 972 186ee2b0fbae609d44351da0241dd0ec.exe 972 186ee2b0fbae609d44351da0241dd0ec.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription pid process Token: SeDebugPrivilege 972 186ee2b0fbae609d44351da0241dd0ec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
186ee2b0fbae609d44351da0241dd0ec.exedescription pid process target process PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe PID 972 wrote to memory of 1892 972 186ee2b0fbae609d44351da0241dd0ec.exe 186ee2b0fbae609d44351da0241dd0ec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\186ee2b0fbae609d44351da0241dd0ec.exe"C:\Users\Admin\AppData\Local\Temp\186ee2b0fbae609d44351da0241dd0ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\186ee2b0fbae609d44351da0241dd0ec.exe"C:\Users\Admin\AppData\Local\Temp\186ee2b0fbae609d44351da0241dd0ec.exe"2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEMD5
9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
memory/972-55-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/972-57-0x0000000076A21000-0x0000000076A23000-memory.dmpFilesize
8KB
-
memory/972-58-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/972-59-0x0000000000380000-0x0000000000387000-memory.dmpFilesize
28KB
-
memory/972-60-0x0000000004A30000-0x0000000004A92000-memory.dmpFilesize
392KB
-
memory/972-61-0x0000000000560000-0x00000000005A0000-memory.dmpFilesize
256KB
-
memory/1892-64-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-63-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-65-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-66-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-67-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-68-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-70-0x0000000000408178-mapping.dmp
-
memory/1892-69-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-72-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1892-62-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB