Overview

overview

10

Static

static

7cb950b590...a9.exe

windows7_x64

10

7cb950b590...a9.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    162s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 00:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe

  • Size

    1.3MB

  • MD5

    2140adb39cf86f635f1c2d16dbe89970

  • SHA1

    0aa79344a9f2f0a76f522b414701a74dab070167

  • SHA256

    7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9

  • SHA512

    29d3991345197f6d482597cfb42349737eacb339f2e77f15f625622a80347de835c5198d4d3980319e3ab63613e9d1a10a8b3558f0c71643e8d5a6bae54bfa66

Score
10/10
neshtaevasionpersistenceransomwarespyware

Malware Config

Extracted

Path

C:\Decryption-Guide.txt

Ransom Note
Your Files Are Has Been Locked Your Files Has Been Encrypted with cryptography Algorithm If You Need Your Files And They are Important to You, Dont be shy Send Me an Email Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored Make an Agreement on Price with me and Pay Get Decryption Tool + RSA Key AND Instruction For Decryption Process Attention: 1- Do Not Rename or Modify The Files (You May loose That file) 2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time ) 3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files 4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client) this Was happened Your Case ID :MJ-RZ5964312708 OUR Email :[email protected]

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • NTFS ADS 7 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe
    "C:\Users\Admin\AppData\Local\Temp\7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Users\Admin\AppData\Local\Temp\3582-490\7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\SysWOW64\net.exe
          net stop MSDTC
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop MSDTC
            5⤵
              PID:2300
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:3552
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
            3⤵
              PID:4404
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
              3⤵
                PID:4876
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3656
                • C:\Windows\SysWOW64\net.exe
                  net stop SQLSERVERAGENT
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3904
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop SQLSERVERAGENT
                    5⤵
                      PID:4188
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1476
                  • C:\Windows\SysWOW64\net.exe
                    net stop MSSQLSERVER
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1308
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop MSSQLSERVER
                      5⤵
                        PID:4384
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:804
                    • C:\Windows\SysWOW64\net.exe
                      net stop vds
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3088
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop vds
                        5⤵
                          PID:3836
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:632
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh advfirewall set currentprofile state off
                        4⤵
                          PID:2000
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2492
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh firewall set opmode mode=disable
                          4⤵
                            PID:2592
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c net stop SQLWriter
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5028
                          • C:\Windows\SysWOW64\net.exe
                            net stop SQLWriter
                            4⤵
                              PID:1492
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop SQLWriter
                                5⤵
                                  PID:1528
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                              3⤵
                                PID:3992
                                • C:\Windows\SysWOW64\net.exe
                                  net stop SQLBrowser
                                  4⤵
                                    PID:1060
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop SQLBrowser
                                      5⤵
                                        PID:3920
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                    3⤵
                                      PID:1276
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop MSSQLSERVER
                                        4⤵
                                          PID:4820
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop MSSQLSERVER
                                            5⤵
                                              PID:2292
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                          3⤵
                                            PID:3016
                                            • C:\Windows\SysWOW64\net.exe
                                              net stop MSSQL$CONTOSO1
                                              4⤵
                                                PID:4832
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                  5⤵
                                                    PID:1440
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                            1⤵
                                            • Drops file in Windows directory
                                            PID:1292

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe
                                            MD5

                                            d18aad284f150b7eeaeabfb6b033563f

                                            SHA1

                                            0ef010f14a8692082ccd94b786cf5f93bc5f2e12

                                            SHA256

                                            85bae053b7c9561837e65e1f5d5b02f5cabb63fdd544d62e743fd291daa965c2

                                            SHA512

                                            359946d43f186224e881e873fb1f35ac1856ad9ffcdc1ad73f71bcc5c1403b07ca6d56114c859f088138d180635e70ba669abe0a4183e746cfadbfa2bde67807

                                            Download Submit
                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\7cb950b5904260b19798a6eb12d7bf1610a5725966d82fd7bef1550fc1a400a9.exe
                                            MD5

                                            d18aad284f150b7eeaeabfb6b033563f

                                            SHA1

                                            0ef010f14a8692082ccd94b786cf5f93bc5f2e12

                                            SHA256

                                            85bae053b7c9561837e65e1f5d5b02f5cabb63fdd544d62e743fd291daa965c2

                                            SHA512

                                            359946d43f186224e881e873fb1f35ac1856ad9ffcdc1ad73f71bcc5c1403b07ca6d56114c859f088138d180635e70ba669abe0a4183e746cfadbfa2bde67807

                                            Download Submit
                                          • C:\odt\office2016setup.exe
                                            MD5

                                            22a9c2d4e6f11925037aa9dd07879b5a

                                            SHA1

                                            33bfaba0794afeeb43cda0a89e0b14ef0536cfbe

                                            SHA256

                                            48fc55b56cdf3a01d70d293d0468a4d90b5efcfb5a7a2ce2b31a6fb768541e50

                                            SHA512

                                            4ff5b1c2a22a77deb9978e7e8ecec71b9163aa9d86683c72707f912773b2ca0ab265cd3627278522d2ec0c4471b4978bb0ae37c9be0dcb745031aaa8fff405fb

                                            Download Submit