Analysis
-
max time kernel
59s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 15:10
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20220721-en
General
-
Target
1.exe
-
Size
851KB
-
MD5
286099dac2f03c7764d9fc6d8c5e02e2
-
SHA1
eedd56af4f225f991eb63f37597d7ab6e4abeac7
-
SHA256
4d6bee9938b85e65fabba0b920efcff479e565ebbdd91a7d6a631fa7475e9f74
-
SHA512
63cf51afd8a4cf8c8afdb498dbf589b12b86c8b978313e9a41ad9dbf1f511cac55b938fa479b8d76e1330df7b7dd6c5be94759165467eb234d6dbc5380edc3b9
Malware Config
Signatures
-
Detect Neshta payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-72-0x00000000004080E4-mapping.dmp family_neshta behavioral1/memory/1748-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-75-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" InstallUtil.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Loads dropped DLL 2 IoCs
Processes:
InstallUtil.exepid process 1748 InstallUtil.exe 1748 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ddhnvo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Wirkpkfbm\\Ddhnvo.exe\"" 1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1.exedescription pid process target process PID 1276 set thread context of 1748 1276 1.exe InstallUtil.exe -
Drops file in Program Files directory 64 IoCs
Processes:
InstallUtil.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe InstallUtil.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE InstallUtil.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE InstallUtil.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE InstallUtil.exe -
Drops file in Windows directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File opened for modification C:\Windows\svchost.com InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
1.exepowershell.exepid process 1276 1.exe 1900 powershell.exe 1276 1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1.exepowershell.exedescription pid process Token: SeDebugPrivilege 1276 1.exe Token: SeDebugPrivilege 1900 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1.exedescription pid process target process PID 1276 wrote to memory of 1900 1276 1.exe powershell.exe PID 1276 wrote to memory of 1900 1276 1.exe powershell.exe PID 1276 wrote to memory of 1900 1276 1.exe powershell.exe PID 1276 wrote to memory of 1900 1276 1.exe powershell.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe PID 1276 wrote to memory of 1748 1276 1.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
851KB
MD5286099dac2f03c7764d9fc6d8c5e02e2
SHA1eedd56af4f225f991eb63f37597d7ab6e4abeac7
SHA2564d6bee9938b85e65fabba0b920efcff479e565ebbdd91a7d6a631fa7475e9f74
SHA51263cf51afd8a4cf8c8afdb498dbf589b12b86c8b978313e9a41ad9dbf1f511cac55b938fa479b8d76e1330df7b7dd6c5be94759165467eb234d6dbc5380edc3b9
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
851KB
MD5286099dac2f03c7764d9fc6d8c5e02e2
SHA1eedd56af4f225f991eb63f37597d7ab6e4abeac7
SHA2564d6bee9938b85e65fabba0b920efcff479e565ebbdd91a7d6a631fa7475e9f74
SHA51263cf51afd8a4cf8c8afdb498dbf589b12b86c8b978313e9a41ad9dbf1f511cac55b938fa479b8d76e1330df7b7dd6c5be94759165467eb234d6dbc5380edc3b9