neshta | 359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59

General

Target

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
Size

112KB
MD5

8b7611f961f0e2654905ef70c64643d8
SHA1

6179240e198d9cb07b2703be0b725f852303cc97
SHA256

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59
SHA512

708e2ba0d0703e0b392654f928b9c0f478d86a60be9568a0bc9bb080a21ee32fed24d8cdedfe1c6e6651918af6d13a0f23e730c40ae038448d99bcf728195737

Score

10^/10

neshta evasion persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

pid process

1684 359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
1684	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

Loads dropped DLL 3 IoCs

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

pid	process
1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

Drops file in Windows directory 1 IoCs

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

description ioc process

File opened for modification C:\Windows\svchost.com 359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe

Modifies registry class 5 IoCs

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exereg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\FirewallOnOff	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shell\FirewallOnOff\Icon = "C:\\Windows\\system32\\imageres.dll,101"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\FirewallOnOff	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shell\FirewallOnOff\ = "╣µ╚¡║« ╗τ┐δ ╛╚╟╘"	reg.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.execmd.execmd.exe

description	pid	process	target process
PID 1124 wrote to memory of 1684	1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
PID 1124 wrote to memory of 1684	1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
PID 1124 wrote to memory of 1684	1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
PID 1124 wrote to memory of 1684	1124	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
PID 1684 wrote to memory of 976	1684	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	cmd.exe
PID 1684 wrote to memory of 976	1684	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	cmd.exe
PID 1684 wrote to memory of 976	1684	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	cmd.exe
PID 1684 wrote to memory of 976	1684	359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe	cmd.exe
PID 976 wrote to memory of 1704	976	cmd.exe	cmd.exe
PID 976 wrote to memory of 1704	976	cmd.exe	cmd.exe
PID 976 wrote to memory of 1704	976	cmd.exe	cmd.exe
PID 1704 wrote to memory of 1592	1704	cmd.exe	reg.exe
PID 1704 wrote to memory of 1592	1704	cmd.exe	reg.exe
PID 1704 wrote to memory of 1592	1704	cmd.exe	reg.exe
PID 976 wrote to memory of 1564	976	cmd.exe	netsh.exe
PID 976 wrote to memory of 1564	976	cmd.exe	netsh.exe
PID 976 wrote to memory of 1564	976	cmd.exe	netsh.exe
PID 976 wrote to memory of 592	976	cmd.exe	reg.exe
PID 976 wrote to memory of 592	976	cmd.exe	reg.exe
PID 976 wrote to memory of 592	976	cmd.exe	reg.exe
PID 976 wrote to memory of 580	976	cmd.exe	reg.exe
PID 976 wrote to memory of 580	976	cmd.exe	reg.exe
PID 976 wrote to memory of 580	976	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
"C:\Users\Admin\AppData\Local\Temp\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\3582-490\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\10B2.tmp\10B3.bat C:\Users\Admin\AppData\Local\Temp\3582-490\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall
4⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\reg.exe
reg query "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall
5⤵
PID:1592

C:\Windows\system32\netsh.exe
netsh advfirewall set privateprofile state on
4⤵
PID:1564

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Classes\Directory\background\shell\FirewallOnOff" /v "Icon" /t REG_SZ /d "C:\Windows\system32\imageres.dll,101" /f
4⤵
- Modifies registry class
PID:592

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Classes\Directory\background\shell\FirewallOnOff" /ve /t REG_SZ /d "╣µ╚¡║« ╗τ┐δ ╛╚╟╘" /f
4⤵
- Modifies registry class
PID:580

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\10B2.tmp\10B3.bat
MD5
0eb9a79994c76138fede24c947c5b616

SHA1
4953b14a02ebd61c7f112e1be2f5befa41d82ca6

SHA256
eb9a37341edc21ca2e5c199637269425d978ca3b41ae23d6486cd125204e0cca

SHA512
b106115e734afc090645092effec1015f051d394897ca584601a5a6960686e7046021fde7ec94555fc3c4c3c42f59b81b2920e665e87b231bbe74e64aa4dea27

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
MD5
4c7f6c95f09cad4461bd307a2c66d3f8

SHA1
add6f61d5490c5873872d313b8d0486ec08c3ed7

SHA256
a3e6aa14ac199c4c051c2646a15bb1d6b6fdfc53afde6b0c43886d2b21e35927

SHA512
3e0310da9041f6ecb8f3f12fd08076def65b4c9bdf14b48701d0c297571180f844d6c71d4c943eade5a4ad877ae471758584576c93188476ea92b3c313429da2

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
MD5
4c7f6c95f09cad4461bd307a2c66d3f8

SHA1
add6f61d5490c5873872d313b8d0486ec08c3ed7

SHA256
a3e6aa14ac199c4c051c2646a15bb1d6b6fdfc53afde6b0c43886d2b21e35927

SHA512
3e0310da9041f6ecb8f3f12fd08076def65b4c9bdf14b48701d0c297571180f844d6c71d4c943eade5a4ad877ae471758584576c93188476ea92b3c313429da2

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\359b201b01aee5f412ec6a65e9504a70459ebbe77ebfdb6eb37b42651d6c7c59.exe
MD5
4c7f6c95f09cad4461bd307a2c66d3f8

SHA1
add6f61d5490c5873872d313b8d0486ec08c3ed7

SHA256
a3e6aa14ac199c4c051c2646a15bb1d6b6fdfc53afde6b0c43886d2b21e35927

SHA512
3e0310da9041f6ecb8f3f12fd08076def65b4c9bdf14b48701d0c297571180f844d6c71d4c943eade5a4ad877ae471758584576c93188476ea92b3c313429da2

Download Submit
memory/1124-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1564-60-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads