Analysis
-
max time kernel
164s -
max time network
176s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 06:24
General
-
Target
7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exe
-
Size
2.4MB
-
MD5
ae47016cc9ce531df98e6e9da5eeb076
-
SHA1
ea0ed319bb94742b01a26cefb29f7fc1c8a811a4
-
SHA256
7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d
-
SHA512
e694595ff92e8b8a93a3b432419b2e73e03f15ad3af1959dda7169f1884a0c025d1c422eac6548a137dbe1e847c21683579a22ec3545abf864ad5f0a3efdbc26
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
UAC bypass 3 TTPs
-
Windows security bypass 2 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exe"C:\Users\Admin\AppData\Local\Temp\7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exe"2⤵
- Modifies firewall policy service
- Modifies system executable filetype association
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exeMD5
7cd7b267d136ec6dcc9d7152f5c2eada
SHA10bb1cf210a03b93bb54bbfce35b652dcb2626264
SHA2563f015bc2f53bb9e381ee9473fb9984fbf23b583f5b241e9582da70cff97eb6db
SHA51210f15b466673b062f529adf61fa94ef1519589c6367b88a9d194adf707712b228d5136441facfac9bacc833f9884e623bf23ce9689c8ac08531b0a3a4d3cb640
-
C:\Users\Admin\AppData\Local\Temp\3582-490\7677f02eba76f2cf42d55ef859b22976d79db2de3c67f613b8054b13f43fb08d.exeMD5
7cd7b267d136ec6dcc9d7152f5c2eada
SHA10bb1cf210a03b93bb54bbfce35b652dcb2626264
SHA2563f015bc2f53bb9e381ee9473fb9984fbf23b583f5b241e9582da70cff97eb6db
SHA51210f15b466673b062f529adf61fa94ef1519589c6367b88a9d194adf707712b228d5136441facfac9bacc833f9884e623bf23ce9689c8ac08531b0a3a4d3cb640
-
C:\Windows\SYSTEM.INIMD5
b2b4286fe0ea255ef5900c8930a50015
SHA1fa4cb2f615a39c763e906faff1b0eb6aa9ecbddc
SHA256e9f6eeea30a171e9b074a471c868b73b060e2f80ef8af702c8dbeb1b39f46b8a
SHA512996a03b09d0e5245657fafa24a1faf505b49339cc4b101893454ca17a2c03aaddff975fd969de9b591bb1f79256ee2347617f7228ccd71e66cbfebda6e631709
-
memory/2432-120-0x0000000002660000-0x00000000036EE000-memory.dmpFilesize
16.6MB
-
memory/2432-121-0x0000000001000000-0x000000000125D000-memory.dmpFilesize
2.4MB
-
memory/2432-122-0x0000000002660000-0x00000000036EE000-memory.dmpFilesize
16.6MB
-
memory/3264-123-0x00000000026E0000-0x00000000026E2000-memory.dmpFilesize
8KB
-
memory/3264-124-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/3264-125-0x0000000003260000-0x00000000042EE000-memory.dmpFilesize
16.6MB
-
memory/3264-127-0x0000000003260000-0x00000000042EE000-memory.dmpFilesize
16.6MB