Analysis

  • max time kernel
    62s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2022 21:35

General

  • Target

    0893f96ed6831c745ebc3d19d9f96749.exe

  • Size

    18KB

  • MD5

    0893f96ed6831c745ebc3d19d9f96749

  • SHA1

    5b33dfac19433268f3c8964aecd6cdc83569cfa6

  • SHA256

    ca4a862e957347dc3501e55fcf6ab8d130f141afea00c22f3bf25bf938531a35

  • SHA512

    0a2e3b791c24f741ce34f52c375f91a7d1bc4139e56fe9f6a08bef11c6cc4aeb510fa50c4605e5b79d19d1460fb87994d6fd9d6fe5d82031d4c6520154144d28

Malware Config

Signatures

  • Detect Neshta payload 7 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0893f96ed6831c745ebc3d19d9f96749.exe
    "C:\Users\Admin\AppData\Local\Temp\0893f96ed6831c745ebc3d19d9f96749.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANAA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1972
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Modifies system executable filetype association
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      PID:1444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

    Filesize

    252KB

    MD5

    9e2b9928c89a9d0da1d3e8f4bd96afa7

    SHA1

    ec66cda99f44b62470c6930e5afda061579cde35

    SHA256

    8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

    SHA512

    2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

  • memory/1180-54-0x00000000008E0000-0x00000000008EA000-memory.dmp

    Filesize

    40KB

  • memory/1180-55-0x0000000075481000-0x0000000075483000-memory.dmp

    Filesize

    8KB

  • memory/1180-56-0x0000000005050000-0x00000000050EC000-memory.dmp

    Filesize

    624KB

  • memory/1180-57-0x0000000004D80000-0x0000000004E12000-memory.dmp

    Filesize

    584KB

  • memory/1444-72-0x00000000004080E4-mapping.dmp

  • memory/1444-71-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-62-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-63-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-65-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-66-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-67-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-68-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-69-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-79-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-78-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-73-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-75-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1444-76-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/1972-58-0x0000000000000000-mapping.dmp

  • memory/1972-60-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

    Filesize

    5.7MB

  • memory/1972-61-0x000000006E5A0000-0x000000006EB4B000-memory.dmp

    Filesize

    5.7MB