Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2022 12:23

General

  • Target

    Pre Alert Notice.exe

  • Size

    2.1MB

  • MD5

    66ec236f7e3706529af4c68b2d557507

  • SHA1

    507f6c2309ed1bf9ccaf6f3cd9d77c9047732e0f

  • SHA256

    002627ee9699b28cedc585da9a1bec3421da624eadcfc42bbb7f64471c8c770a

  • SHA512

    e1b6155c4edd32d9109597c588a00052bcba3106cce377e7cc9ad2427463f658912ea87c278e75efe9dac56f6b3e2e9e2469795469cf9ce5c9ab626f23ee31a5

Malware Config

Signatures

  • Detect Neshta payload 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pre Alert Notice.exe
    "C:\Users\Admin\AppData\Local\Temp\Pre Alert Notice.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANwA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:376
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:4560
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        2⤵
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        PID:3788

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Sdfwbjjt\Exjfj.exe

      Filesize

      2.2MB

      MD5

      be246f1439e5e473fb368512a2ba92f5

      SHA1

      5f23cec69a9e215f8730f75222c642921e1f7fe8

      SHA256

      5dd122e49f7482a7016e4802fc224533596b91a66a4c63a0f75a36f4641c960f

      SHA512

      537f70f91e9467b100ecf8129b74fb62efcbcd6f59c4c0a78601df1bb01e3f3407e9ac61098e8013ad3c34adfe0bff63727c05c87072342594158b989f0035ef

    • memory/376-139-0x0000000006700000-0x000000000671A000-memory.dmp

      Filesize

      104KB

    • memory/376-132-0x0000000000000000-mapping.dmp

    • memory/376-133-0x0000000004C10000-0x0000000004C46000-memory.dmp

      Filesize

      216KB

    • memory/376-134-0x00000000052E0000-0x0000000005908000-memory.dmp

      Filesize

      6.2MB

    • memory/376-135-0x0000000005B00000-0x0000000005B66000-memory.dmp

      Filesize

      408KB

    • memory/376-136-0x0000000005B70000-0x0000000005BD6000-memory.dmp

      Filesize

      408KB

    • memory/376-137-0x00000000061F0000-0x000000000620E000-memory.dmp

      Filesize

      120KB

    • memory/376-138-0x0000000007860000-0x0000000007EDA000-memory.dmp

      Filesize

      6.5MB

    • memory/2016-140-0x0000000005890000-0x0000000005922000-memory.dmp

      Filesize

      584KB

    • memory/2016-130-0x0000000000410000-0x0000000000634000-memory.dmp

      Filesize

      2.1MB

    • memory/2016-141-0x000000000CE10000-0x000000000D3B4000-memory.dmp

      Filesize

      5.6MB

    • memory/2016-131-0x0000000005270000-0x0000000005292000-memory.dmp

      Filesize

      136KB

    • memory/3788-143-0x0000000000000000-mapping.dmp

    • memory/3788-144-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/3788-145-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/3788-146-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/3788-147-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/3788-149-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/3788-150-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/4560-142-0x0000000000000000-mapping.dmp