neshta | 8a8c22f532003426966f40a78e7bf11a0cde251f995dadf7e1a65e8c81c9008e

Analysis

max time kernel
153s
max time network
139s
platform
windows7_x64
resource
win7-en-20211208
submitted
06-02-2022 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER-021406_pdf.jar
Size

115KB
MD5

9b1704c9472dec7f1a64667093192a29
SHA1

0412046a5e917a5773043db094e6088897e00519
SHA256

0f081b6ad1242ba0528e7f7058c0f98ec52299272d63844735fa6574ba7ecb85
SHA512

c26b7b6a9ac198f55cf1b832557cc71d03a4fdec0c3f754d1b8762fee359c4191905904e6ebaebf0abfc16c710912437c9ceb6527b5c43ae17996b46368962a1

Score

10^/10

neshta persistence spyware stealer suricata

Malware Config

Signatures

Detect Neshta Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\cq4u.exe	family_neshta
C:\Users\Admin\cq4u.exe	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1042

Processes:

cq4u.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" cq4u.exe
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
suricata: ET MALWARE DTLoader Binary Request M2
suricata: ET MALWARE DTLoader Binary Request M2
suricata
Executes dropped EXE 2 IoCs

Processes:

cq4u.execq4u.exe

pid process

1728 cq4u.exe
1720 cq4u.exe
Loads dropped DLL 7 IoCs

Processes:

cq4u.exeWerFault.exe

pid process

1728 cq4u.exe
1728 cq4u.exe
2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	cq4u.exe

pid	process
1728	cq4u.exe
1720	cq4u.exe

pid	process
1728	cq4u.exe
1728	cq4u.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe

Drops file in Program Files directory 64 IoCs

Processes:

cq4u.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	cq4u.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	cq4u.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	cq4u.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	cq4u.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	cq4u.exe

Drops file in Windows directory 1 IoCs

Processes:

cq4u.exe

description ioc process

File opened for modification C:\Windows\svchost.com cq4u.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 1720 WerFault.exe cq4u.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
File opened for modification	C:\Windows\svchost.com	cq4u.exe

pid	pid_target	process	target process
2000	1720	WerFault.exe	cq4u.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1120 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
2000 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cq4u.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1720 cq4u.exe
Token: SeDebugPrivilege 2000 WerFault.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

java.exeEXCEL.EXE

pid process

1312 java.exe
1120 EXCEL.EXE
1120 EXCEL.EXE
1120 EXCEL.EXE

pid	process
1120	EXCEL.EXE

pid	process
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1720	cq4u.exe
Token: SeDebugPrivilege	2000	WerFault.exe

pid	process
1312	java.exe
1120	EXCEL.EXE
1120	EXCEL.EXE
1120	EXCEL.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

java.execq4u.execq4u.exe

description	pid	process	target process
PID 1312 wrote to memory of 1728	1312	java.exe	cq4u.exe
PID 1312 wrote to memory of 1728	1312	java.exe	cq4u.exe
PID 1312 wrote to memory of 1728	1312	java.exe	cq4u.exe
PID 1312 wrote to memory of 1728	1312	java.exe	cq4u.exe
PID 1728 wrote to memory of 1720	1728	cq4u.exe	cq4u.exe
PID 1728 wrote to memory of 1720	1728	cq4u.exe	cq4u.exe
PID 1728 wrote to memory of 1720	1728	cq4u.exe	cq4u.exe
PID 1728 wrote to memory of 1720	1728	cq4u.exe	cq4u.exe
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1312 wrote to memory of 1120	1312	java.exe	EXCEL.EXE
PID 1720 wrote to memory of 2000	1720	cq4u.exe	WerFault.exe
PID 1720 wrote to memory of 2000	1720	cq4u.exe	WerFault.exe
PID 1720 wrote to memory of 2000	1720	cq4u.exe	WerFault.exe
PID 1720 wrote to memory of 2000	1720	cq4u.exe	WerFault.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ORDER-021406_pdf.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312

C:\Users\Admin\cq4u.exe
C:\Users\Admin\cq4u.exe
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 1096
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
C:\Users\Admin\MesOB51I7.xlsx
MD5
babea5182cea94bafda9a125c71f0b33

SHA1
fa449309136bb8d7a05ccab8aec4c2d85d2e6f65

SHA256
1f1bf58d07b84d0981d6226e8a9cce01526f37b1ca8472f66398b2fa370c8e72

SHA512
d7d6d0fe02508dcd3705384c205b69f128a75f4196ab0f14be820b007f0c097d3490b73fffc93a81c855645fa1a28a63f8027baa68fee56efe959810e2476297

Download Submit
C:\Users\Admin\cq4u.exe
MD5
71b56603c0d5a3504d5f4ec61540f630

SHA1
3999fac595a275739d8142ffc90f1b707b9c3d31

SHA256
925d620fc769a4db1a3fb08379fbf8ffbacb73a55768e083950d6f5360fb0645

SHA512
fc91f255d42759cfd5cf8eab63f969f1e29c47e1b54c6ca0c897841a052b68a4ac5921587a9aae6267717f88453c101c12de26ead61f11dc25ffa1aeaf2675f1

Download Submit
C:\Users\Admin\cq4u.exe
MD5
71b56603c0d5a3504d5f4ec61540f630

SHA1
3999fac595a275739d8142ffc90f1b707b9c3d31

SHA256
925d620fc769a4db1a3fb08379fbf8ffbacb73a55768e083950d6f5360fb0645

SHA512
fc91f255d42759cfd5cf8eab63f969f1e29c47e1b54c6ca0c897841a052b68a4ac5921587a9aae6267717f88453c101c12de26ead61f11dc25ffa1aeaf2675f1

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\cq4u.exe
MD5
d56c3670c975055b327498b1f6d21b7d

SHA1
11b54837674223b45dddd7300903fa5078a9a04f

SHA256
73583c9268aba6ca2ab7572919c71e5d0cb8c4cf1a1c5ce65f7e2a41159cc177

SHA512
357ff67ee7a576e417d258ce1aac9fb9a762bedcdba71747cab608f66c67cfcd25c6d112872f7a6c5f3fe9e794764d9f1979c3b78369735ac3e94349f1c77644

Download Submit
memory/1120-72-0x000000006FEF1000-0x000000006FEF3000-memory.dmp

Filesize
8KB

Download
memory/1120-74-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1120-70-0x000000002F071000-0x000000002F074000-memory.dmp

Filesize
12KB

Download
memory/1120-93-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1312-57-0x00000000021A0000-0x00000000051A0000-memory.dmp

Filesize
48.0MB

Download
memory/1312-84-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1312-55-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download
memory/1312-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1312-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1720-76-0x0000000004640000-0x0000000004641000-memory.dmp

Filesize
4KB

Download
memory/1720-71-0x0000000000E50000-0x0000000000E74000-memory.dmp

Filesize
144KB

Download
memory/1728-59-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/2000-92-0x0000000000AC0000-0x0000000000AE4000-memory.dmp

Filesize
144KB

Download