neshta | 55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a

Analysis

max time kernel
157s
max time network
126s
platform
windows7_x64
resource
win7-en-20211208
submitted
06-02-2022 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
Size

1.6MB
MD5

c4ad102a06da79a5ded9cc07a477261d
SHA1

56d35fdc72491488a668dc14f9da84277d592391
SHA256

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a
SHA512

892a430372fd9457eb97e6cf68c588cd7d0ecd0f72fa4422aedadbcfd2889d545b6054fc87add716d013eb5a239217e9a438ef5f32db89aa0f1b1f52be2c19de

Score

10^/10

neshta evasion persistence spyware stealer trojan

Malware Config

Signatures

Detect Neshta Payload 15 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	family_neshta
\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exesvchost.com

pid process

972 55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
308 svchost.com

pid	process
972	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
308	svchost.com

Loads dropped DLL 4 IoCs

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exesvchost.com

pid	process
1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
308	svchost.com
1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.com55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	svchost.com
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	svchost.com

Drops file in Windows directory 3 IoCs

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exesvchost.com

description	ioc	process
File opened for modification	C:\Windows\svchost.com	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

pid process

972 55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

pid	process
972	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exesvchost.com

description	pid	process	target process
PID 1604 wrote to memory of 972	1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
PID 1604 wrote to memory of 972	1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
PID 1604 wrote to memory of 972	1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
PID 1604 wrote to memory of 972	1604	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
PID 972 wrote to memory of 308	972	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	svchost.com
PID 972 wrote to memory of 308	972	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	svchost.com
PID 972 wrote to memory of 308	972	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	svchost.com
PID 972 wrote to memory of 308	972	55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe	svchost.com
PID 308 wrote to memory of 1904	308	svchost.com	READER~1.EXE
PID 308 wrote to memory of 1904	308	svchost.com	READER~1.EXE
PID 308 wrote to memory of 1904	308	svchost.com	READER~1.EXE
PID 308 wrote to memory of 1904	308	svchost.com	READER~1.EXE

C:\Users\Admin\AppData\Local\Temp\55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
"C:\Users\Admin\AppData\Local\Temp\55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Local\Temp\3582-490\55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\PROGRA~2\Adobe\READER~1.0\Reader\READER~1.EXE"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:308

C:\PROGRA~2\Adobe\READER~1.0\Reader\READER~1.EXE
C:\PROGRA~2\Adobe\READER~1.0\Reader\READER~1.EXE
4⤵
PID:1904

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
MD5
9306f2a522a57b846007a08f1ca66f03

SHA1
df4ba0ea9393304bce52879d4b9344a0f1277d20

SHA256
0b3954c2f43c8c55e3d23bc7c97acf57022b9ced4360fe7d8660e77a1fbb3372

SHA512
dfc6336d1115a7337905341d0579700df3f821d4be340faa603a30668152e061818628e7544a2f0b4767c40baffe37554d040644dfd0d1da8ef3de0e25dd171b

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
MD5
e0f2257e0ad4b04429c932673ead4884

SHA1
352fcc1fe1019cd069ab52b409b31bbd0a08ea9a

SHA256
6e11a49479c1d2b35f15901b0700e307712338f343e1c03fcfe715946fab5969

SHA512
d77e790e63b1b2307df2ef0bb774bcbfa5cdc716764050dfa055a23449cffa5c6f61759b0819712f3e3be06037cbc3469082ba2b02af990017f28658f0103763

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
MD5
05137767de39f2bb28b365b2238f32e1

SHA1
5e62f303be2d32f16da8ebe555eb80491f7c0efb

SHA256
ca65573ff40bd61e73cf21f24a122de99e5face2ce75a2e0753f93e10cf6495b

SHA512
9f29611adeac506c6db62a47d82fe5891688cfffc7217ad1dd076fc88e54ea4b9291974b168922245f6c8e302f4e03a273bf0ac9942ac4d1cf6c5a6099b9f0be

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
MD5
98359abd5f26fc75169bafd6edcf00cd

SHA1
c0bdcc5b5f48c72275f84d6166a42519cc5f2028

SHA256
958bf8d76d4de0bbba6aadea0c4aff0ec7be9cc69ab9fa61cd29dcecbf3528fa

SHA512
573e374866e93b14cec6b5192ba45529a89c140d023ec0e471bad563fd6893cbef2a2fb0b106732f40fd4a2629869c8074b991539b05ade3d38f32aa26751fe2

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe
MD5
9b9869e0df0acac9babac95a1f8d5c7d

SHA1
9ea411c302c9a2c565c941631128a7b23992530f

SHA256
963167bf45b0acb36b0d968e70e486f0956ace3fe2a48e6e26e9482df829c9d3

SHA512
cae5f2e81f7811f6c3307cfbfd2d8e8350bb048333ff3484a090cde2ac13b2709fc0f95f0a851b00d16d27601cb4e457028ecd689b66ed3ac8a716454403c0a2

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE
MD5
4ce04c0dd629a2f4af4ad3be07aad000

SHA1
f9dc3fe0b2d2298dae957703b437d8d120568865

SHA256
449132eb19f76e0d021f524f619e72e0cba989161c3a380268f688fae135e664

SHA512
314de1ecf1a2d367631e4a69757db6ff298a956ecbf912a702c381933fc1a262ee9cf70cf4e2f09bac13db743a4591b2c674b19c3d103eeb408f61284b4ac1b9

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE
MD5
ab8046d6d42d50ef5431563bdd3c0117

SHA1
36d4b3bbc1243aecc3405fca087e37bc195fe412

SHA256
2dcb5f295233f7b626e04ef9c5942c804d4a5ea96acc23dd861b5dc99eaae5ba

SHA512
72cbdb9963fa540a702d48756e1360f62fc516af007387730e46406f3d57e18bf9602a238326e9791cdc06f955c44995f12b17d665102a49ab56c1d28fe7017a

Download Submit
C:\PROGRA~2\MICROS~1\Office14\OIS.EXE
MD5
931f0607bfb5a8149c9b14121a9237c4

SHA1
92edf8554a4e5fe1a86a157656a9683f47a1017f

SHA256
88eebf3fe1e9e82a77a6c5bac14ff2384e59cf1ae576d7f23f3a8fc4ef9bdb82

SHA512
7ea52ada3f119fe00dee1ed710eee02ebe80a5adc8a0085b87732e94d5cac0df92210fefc79f6977b0194aed2cff07a4cf53df3e00ebfd0e6fbd3efa0890f7ac

Download Submit
C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE
MD5
ee65b7a6d357fbecfea9371cda88657d

SHA1
b675606e516f20012d66a05a4be5218a34e8025b

SHA256
c5aef6e27ea5c33464702068c53099c2134238fccd4e4a010cde1e20affbbf81

SHA512
5be3dd1ad2128fa837ecac447beb0866215a07c97d29ff58d8f29bb5b5da2670ed4cad569f307eec86740b974d098ac563f769f7da3062cb4666d72c55337978

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
MD5
30f41c2c0417dd0328ce0f0c150275a9

SHA1
10c85349c26d746fcd93528ff2c0155daf703fb7

SHA256
00098459575636cfeb2c7df17a1d7971b7a61a2e6c14125d758baa13f870963e

SHA512
288d429fac506b6d844b72885d2552f86a92ff09b9274fe2a629da9577c3681de8aa92b0cda315a0b0b9282194e29545e40cbcd60f4e58faa4c7c70edb8de317

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
MD5
b38d3dbb9687fc614d22e72e016bf5f0

SHA1
79a7f59d311b3ba8238cbc99ae921bcd9005088f

SHA256
ef0a018061cee0ec72240d670a061c76775a80187ecd4b005e4dcf4aa0aeec14

SHA512
63b9dd78401577343da4942be2b5124495f1be9a685adb40147a41813782b299484c606ad69be624b509429d9bf912fdee4f7d7e2c2bab5d8ddb33aaa89e7c4e

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE
MD5
955ceac3b7183ef97f36fa9e892ac4ab

SHA1
caf6f55bda39e36f1927f2ca761cb586a18e5b7d

SHA256
c6004c82c1a278a079aa8c6aaf371a5f13f5332449987e3cbe2dc772e99c6ede

SHA512
78e98b88a20f54d6fa434140afe88e58c3053aae8b2c8bf8bb69277d822086622a7a9aca976aa64bedb609544b980618a10bf88d3b46284e0234f109227ee9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
MD5
8f9a1733d2a9aea90186f7f2899fb9db

SHA1
cf6b567610932fac8a104a2efccebd7bc732d749

SHA256
5682fc04d2034c28ad7882a207407022f541e3efe80337a447ca5a3b457002af

SHA512
bb8079624a61975b1d540a85f1bf4fa5474dad32b54f9ca916548c9dcbccc7a6fdedcc5ba29f7fc6aeba01c0f41a5386f892c6b767828e016c4eb51b3ca9d69c

Download Submit
C:\Windows\svchost.com
MD5
d1499f582a63bc6e26debc4d6c439773

SHA1
efff51429486363749484600cab910c0768e85a9

SHA256
8005691f4eff8d78f866243532f583826a4c2bdd009eab278c60ef64fc260209

SHA512
eadfee975290db3474ec669c83f98f974fe19d85873a4d5344a467ffaf2f689f538152dca598cb246a323a988a2ee9198543d8950bdba59c710c4f2efc412fca

Download Submit
C:\Windows\svchost.com
MD5
d1499f582a63bc6e26debc4d6c439773

SHA1
efff51429486363749484600cab910c0768e85a9

SHA256
8005691f4eff8d78f866243532f583826a4c2bdd009eab278c60ef64fc260209

SHA512
eadfee975290db3474ec669c83f98f974fe19d85873a4d5344a467ffaf2f689f538152dca598cb246a323a988a2ee9198543d8950bdba59c710c4f2efc412fca

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe
MD5
9b9869e0df0acac9babac95a1f8d5c7d

SHA1
9ea411c302c9a2c565c941631128a7b23992530f

SHA256
963167bf45b0acb36b0d968e70e486f0956ace3fe2a48e6e26e9482df829c9d3

SHA512
cae5f2e81f7811f6c3307cfbfd2d8e8350bb048333ff3484a090cde2ac13b2709fc0f95f0a851b00d16d27601cb4e457028ecd689b66ed3ac8a716454403c0a2

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\55a338b1d8ac98b5075c7ea83e27eb457aa0df1684fd923864020e99f7817c2a.exe
MD5
8f9a1733d2a9aea90186f7f2899fb9db

SHA1
cf6b567610932fac8a104a2efccebd7bc732d749

SHA256
5682fc04d2034c28ad7882a207407022f541e3efe80337a447ca5a3b457002af

SHA512
bb8079624a61975b1d540a85f1bf4fa5474dad32b54f9ca916548c9dcbccc7a6fdedcc5ba29f7fc6aeba01c0f41a5386f892c6b767828e016c4eb51b3ca9d69c

Download Submit
memory/1604-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads