Analysis
- max time kernel
159s - max time network
185s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/08/2022, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
Payment.js
Resource
win7-20220812-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Payment.js
Resource
win10v2004-20220812-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target Payment.js
- Size 306KB
- Sample220824-he8mmsafg4
- SHA256 f93f81ae70db632c3712e6b705071b80f1af157d015b513e6664276ee0713de4
- MD5 bf9c64705a17a632d24e9a7b9f06d74c
- SHA1 0966506e3041d8fe2b122b55df7e936a9d3bcb42
- SHA512 4a885f324f8575cacaea347f07845224809b8efbd01117cc03ad6d5a7ee2e9d0456f5a6425d421f885f974f794b716688e2d22424dc5b291fb20dca2f9d1f661
- SSDEEP 6144:Rf1F+bMla2E1LgSsKGU0NBVjcahXmEClMlJWSGqmbZZRSECpQVLfj6jN:R1Fm5zgjU0NB9LFmhemNy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Neshta payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000022e14-135.dat family_neshta behavioral2/files/0x0007000000022e14-136.dat family_neshta - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" word.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 5 IoCs
resource yara_rule behavioral2/files/0x0007000000022e14-135.dat family_snakekeylogger behavioral2/files/0x0007000000022e14-136.dat family_snakekeylogger behavioral2/files/0x0007000000022e16-138.dat family_snakekeylogger behavioral2/files/0x0007000000022e16-139.dat family_snakekeylogger behavioral2/memory/2032-140-0x0000000000C90000-0x0000000000CB6000-memory.dmp family_snakekeylogger - Executes dropped EXE 2 IoCs
pid Process 2328 word.exe 2032 word.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation word.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 checkip.dyndns.org - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE word.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE word.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe word.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe word.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE word.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE word.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE word.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe word.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe word.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE word.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE word.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE word.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe word.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE word.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe word.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE word.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe word.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE word.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE word.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe word.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE word.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE word.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE word.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE word.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe word.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe word.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE word.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe word.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE word.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE word.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE word.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe word.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com word.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4420 2032 WerFault.exe 84 - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" word.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2032 word.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2032 word.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5088 wrote to memory of 1404 5088 wscript.exe 82 PID 5088 wrote to memory of 1404 5088 wscript.exe 82 PID 5088 wrote to memory of 2328 5088 wscript.exe 83 PID 5088 wrote to memory of 2328 5088 wscript.exe 83 PID 5088 wrote to memory of 2328 5088 wscript.exe 83 PID 2328 wrote to memory of 2032 2328 word.exe 84 PID 2328 wrote to memory of 2032 2328 word.exe 84 PID 2328 wrote to memory of 2032 2328 word.exe 84
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Payment.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\SsdntTsYUq.js"2⤵PID:1404
-
-
C:\Users\Admin\AppData\Roaming\word.exe"C:\Users\Admin\AppData\Roaming\word.exe"2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\word.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\word.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 15644⤵
- Program crash
PID:4420
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2032 -ip 20321⤵PID:1784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\word.exe
- Size 127KB
- SHA256 b40a784e33284d4379663462415264f23d93ebff448b5619b2a7a0065f6e454a
- MD5 834a6604493ff3b917a2971f1bc476a5
- SHA1 62f0ed220a576d91aa26305b4fe951bea4fbe881
- SHA512 6162aee0201d66205d6083753e7586a0225e910a135c963cc55f43b5a51147a3c50ea4d18ea5c10a6deb8e5aaa78377743d09a9fcd043d1b030d6c745988a0ef
- SSDEEP 1536:0kAi/bFAcsJs6fL9lm0Hk3HJ9S+hktvYb13pMb/UyQnpiOWB0xF0Kcl:0kAi/sNlm0Hk3HbSDY7Mb8dpwB0xFbY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\word.exe
- Size 127KB
- SHA256 b40a784e33284d4379663462415264f23d93ebff448b5619b2a7a0065f6e454a
- MD5 834a6604493ff3b917a2971f1bc476a5
- SHA1 62f0ed220a576d91aa26305b4fe951bea4fbe881
- SHA512 6162aee0201d66205d6083753e7586a0225e910a135c963cc55f43b5a51147a3c50ea4d18ea5c10a6deb8e5aaa78377743d09a9fcd043d1b030d6c745988a0ef
- SSDEEP 1536:0kAi/bFAcsJs6fL9lm0Hk3HJ9S+hktvYb13pMb/UyQnpiOWB0xF0Kcl:0kAi/sNlm0Hk3HbSDY7Mb8dpwB0xFbY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\SsdntTsYUq.js
- Size 1KB
- SHA256 8c8a222545bb17f97f23bf11a833c23a3a174143344082aa819fe7a37853472c
- MD5 4b5459cf1f9a50ae0064d2dea5a346fe
- SHA1 fd2c283f1bbf049f573310d8ae362d4e1a99dabc
- SHA512 333ac30f33d814110e242aa17fbef5a4598c400554b951cc5755676ac4da56c526462a711a58411722da44cf6f338cac05c01d1037e8afb17bafc41446ebf318
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\word.exe
- Size 167KB
- SHA256 97db074429c34620602136cd6635bab0ecf8fea57ecfc28e40f533e34bbe8498
- MD5 bb4fe0df11de82bf9a3157ef12a89f22
- SHA1 965ef5e758da721498d261b0f5b141b08a40d0b4
- SHA512 8c848a25ef5375ee30fc9b73fdfb7041eac3a12177cd90cd00846cd3f80b482ddb31c33865bc9da02ee0fce55691c15f625717733f76dcb1e0de3810861fee76
- SSDEEP 3072:sr85CHlm0Hk3HbSDY7Mb8dpwB0xFbYMkAi/sD:k994ODYQb6vbUw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\word.exe
- Size 167KB
- SHA256 97db074429c34620602136cd6635bab0ecf8fea57ecfc28e40f533e34bbe8498
- MD5 bb4fe0df11de82bf9a3157ef12a89f22
- SHA1 965ef5e758da721498d261b0f5b141b08a40d0b4
- SHA512 8c848a25ef5375ee30fc9b73fdfb7041eac3a12177cd90cd00846cd3f80b482ddb31c33865bc9da02ee0fce55691c15f625717733f76dcb1e0de3810861fee76
- SSDEEP 3072:sr85CHlm0Hk3HbSDY7Mb8dpwB0xFbYMkAi/sD:k994ODYQb6vbUw
- MD5 SHA1 SHA512 SSDEEP