neshta | f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911

Analysis

max time kernel
170s
max time network
181s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
Size

201KB
MD5

6e64e10abf633d7d99b541819f25f57b
SHA1

71234a62fb0b931103a558e2c34b3cda6a116122
SHA256

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911
SHA512

a01d438a5289d449758124899989230d5d81930f1787aae90fa962c928ecf433bac7ed37544112199296a37d5f3596c99a099673e55cc21d36d734cc8ba02655

Score

10^/10

neshta sodinokibi 19 312 persistence ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

312

iron-mine.ru

qandmmusiccenter.com

yourhappyevents.fr

enews-qca.com

leadforensics.com

lumturo.academy

lovetzuchia.com

sber-biznes.com

randyabrown.com

penumbuhrambutkeiskei.com

johnsonweekly.com

agriturismocastagneto.it

masecologicos.com

jonnyhooley.com

krishnabrawijaya.com

denverwynkoopdentist.com

enactusnhlstenden.com

uci-france.fr

renderbox.ch

dennisverschuur.com

Attributes

net
true
pid
19
prc
ocautoupds.exe
mysqld_opt.exe
msftesql.exe
xfssvccon.exe
mysqld.exe
oracle.exe
agntsvc.exe
mspub.exe
thebat.exe
ocssd.exe
steam.exe
mysqld_nt.exe
powerpnt.exe
sqlbrowser.exe
tbirdconfig.exe
dbeng50.exe
msaccess.exe
sqbcoreservice.exe
outlook.exe
encsvc.exe
infopath.exe
excel.exe
synctime.exe
sqlwriter.exe
thunderbird.exe
sqlservr.exe
winword.exe
dbsnmp.exe
visio.exe
onenote.exe
thebat64.exe
mydesktopqos.exe
sqlagent.exe
firefoxconfig.exe
ocomm.exe
wordpad.exe
mydesktopservice.exe
isqlplussvc.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
312

Signatures

Detect Neshta Payload 10 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe	family_neshta
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Sodinokibi/Revil sample 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	family_sodinokobi
C:\Users\Admin\AppData\Local\Temp\3582-490\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	family_sodinokobi

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exesvchost.com

pid process

1204 f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
2856 svchost.com
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

description	ioc	process
File opened (read-only)	\??\A:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\K:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\H:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\I:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\N:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\P:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\X:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\Z:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\E:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\F:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\J:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\O:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\S:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\U:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\T:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\V:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\B:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\G:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\L:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\M:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\Q:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\R:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\W:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened (read-only)	\??\Y:	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

Drops file in Program Files directory 64 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exesvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

Drops file in Windows directory 3 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exesvchost.com

description	ioc	process
File opened for modification	C:\Windows\svchost.com	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2688 vssadmin.exe
Modifies data under HKEY_USERS 1 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-18_Classes\Local Settings f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

pid	process
2688	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

Modifies registry class 1 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

pid	process
1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 680 vssvc.exe
Token: SeRestorePrivilege 680 vssvc.exe
Token: SeAuditPrivilege 680 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	680	vssvc.exe
Token: SeRestorePrivilege	680	vssvc.exe
Token: SeAuditPrivilege	680	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exef8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exesvchost.comcmd.exe

description	pid	process	target process
PID 2180 wrote to memory of 1204	2180	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
PID 2180 wrote to memory of 1204	2180	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
PID 2180 wrote to memory of 1204	2180	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
PID 1204 wrote to memory of 2856	1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	svchost.com
PID 1204 wrote to memory of 2856	1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	svchost.com
PID 1204 wrote to memory of 2856	1204	f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe	svchost.com
PID 2856 wrote to memory of 2536	2856	svchost.com	cmd.exe
PID 2856 wrote to memory of 2536	2856	svchost.com	cmd.exe
PID 2856 wrote to memory of 2536	2856	svchost.com	cmd.exe
PID 2536 wrote to memory of 2688	2536	cmd.exe	vssadmin.exe
PID 2536 wrote to memory of 2688	2536	cmd.exe	vssadmin.exe
PID 2536 wrote to memory of 2688	2536	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
"C:\Users\Admin\AppData\Local\Temp\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\3582-490\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
5⤵
- Interacts with shadow copies
PID:2688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:680

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
MD5
3ad3461ef1d630f38ed3749838bbedc3

SHA1
8d85b0b392ae75c5d0b004ee9cf5a7b80b1b79e6

SHA256
32be2bca2b848da78c02140a288f1bb771cb66757f90d20126b1bcfd5bb40e62

SHA512
0e95e5181eab14d5820a3a4952018ac9b290fa3b17add8a5e13d893052f1d2a90a2323c62843f6a9e9af00f27e00108b60e0bce2f848e0a4d8ce0cce153db1ba

Download Submit
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
MD5
0d9146d70ac6a41ead1ea2d50d729508

SHA1
b9e6ff83a26aaf105640f5d5cdab213c989dc370

SHA256
0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab

SHA512
c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
MD5
3bf259392097b2c212b621a52da03706

SHA1
c740b063803008e3d4bab51b8e2719c1f4027bf9

SHA256
79538fa3a6cf33b989d43e7311de4d7b0e1a99b60964e3acc00fa3cb49ff8160

SHA512
186a81ec6cfa4c6dbcb2dc51cbd647bf44328077b58575fafab920303ccf259322cd31fccc0bb23418293f1b88d7f21ab3f0d8e3f9af7db4b5d3f7c8978c7934

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
MD5
32853955255a94fcd7587ca9cbfe2b60

SHA1
c33a88184c09e89598f0cabf68ce91c8d5791521

SHA256
64df64b39ac4391aea14eb48b0489e6a970a3ea44c02c6a8f10c278cc0636330

SHA512
8566b69668729d70567ff494de8f241329baf2a7748ab0ebf5a53308c3e53e646100af4f6fc33325f3851030d11ff045a7e85e5897008e95c991990d8f80a997

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
MD5
0d9146d70ac6a41ead1ea2d50d729508

SHA1
b9e6ff83a26aaf105640f5d5cdab213c989dc370

SHA256
0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab

SHA512
c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
MD5
3e8de969e12cd5e6292489a12a9834b6

SHA1
285b89585a09ead4affa32ecaaa842bc51d53ad5

SHA256
7a25fc3b1ce0f1d06a84dd344c8f5a6c4604732f7d13a8aaad504c4376b305cf

SHA512
b14a5936181a1d8c0f966d969a049254238bf1eacdb1da952c2dc084d5d6dcd5d611d2d058d4c00d6384c20046deef5e74ea865c0062bb0761a391a1eaf1640e

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE
MD5
a49eb5f2ad98fffade88c1d337854f89

SHA1
2cc197bcf3625751f7e714ac1caf8e554d0be3b1

SHA256
99da2b7f53a43e0bc01bb52715a37fa87c7f328b4dfac747d7a152ea22e88449

SHA512
4649049a63ce1dfafb632a5b396181bf7fce6364a548660483722329eea13ec0f7df7d7a5c3104e97a1c0f201597fd27d6a1435942a1c1573db2706733aae593

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
MD5
7b4c9fa2f95caaf096b15e129623d657

SHA1
b4e253782de542a520b55205a019bd0dd6695ed8

SHA256
6d484c276965970169270302286bad03d5de1966ae4822873dc4fc8ac5aa8980

SHA512
1f0a4287bd10d2915a87cdc921b20ef5ffc9563dd9d774ffe031b35e63158fe61f46df64d712ef8df844119bb1e43ff17b2f377b7a5d1318c6ad6acd41f91a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\f8d022d707843f03a50e7ec12120c51b7f1521b8ae0f3e2138abfceacb122911.exe
MD5
7b4c9fa2f95caaf096b15e129623d657

SHA1
b4e253782de542a520b55205a019bd0dd6695ed8

SHA256
6d484c276965970169270302286bad03d5de1966ae4822873dc4fc8ac5aa8980

SHA512
1f0a4287bd10d2915a87cdc921b20ef5ffc9563dd9d774ffe031b35e63158fe61f46df64d712ef8df844119bb1e43ff17b2f377b7a5d1318c6ad6acd41f91a28

Download Submit
C:\Windows\svchost.com
MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\Windows\svchost.com
MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\odt\OFFICE~1.EXE
MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
memory/1204-123-0x0000000000F50000-0x0000000000F56000-memory.dmp

Filesize
24KB

Download
memory/1204-122-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/1204-121-0x0000000000BB0000-0x0000000000BD3000-memory.dmp

Filesize
140KB

Download
memory/1204-120-0x0000000000BB0000-0x0000000000BD3000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads