Analysis
- max time kernel
86s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
20/09/2022, 16:50
Behavioral task
behavioral1
Sample
cec81d5e05615fd21e42eaf979e95fa0.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
cec81d5e05615fd21e42eaf979e95fa0.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target cec81d5e05615fd21e42eaf979e95fa0.exe
- Size 1.9MB
- Sample220920-vcgscsdhd2
- SHA256 56c1da0f4839062f36de1c1d10bd94624c096e9b8dae43a4f580d20231d8124e
- MD5 cec81d5e05615fd21e42eaf979e95fa0
- SHA1 05502dffb8587b7670ab3c1f671935b3b2878ee2
- SHA512 72a394de9ec51cb8c09d09f61dbaacc24900baffe94f16195681f4cfb22b77fc6c4c75b245930d437887bd45556377cf3247f715b4944d65b3c37ebd94216b0a
- SSDEEP 49152:xQR6QAuAMLVImaAfqTTCEyNCSay7ATGg1ylle5oUb2c:xo6QLAMZoCEyNCfLQy
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" cec81d5e05615fd21e42eaf979e95fa0.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 1 IoCs
pid Process 4584 cec81d5e05615fd21e42eaf979e95fa0.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cec81d5e05615fd21e42eaf979e95fa0.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~4.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~3.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MIA062~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~2.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13167~1.21\MICROS~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE cec81d5e05615fd21e42eaf979e95fa0.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com cec81d5e05615fd21e42eaf979e95fa0.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" cec81d5e05615fd21e42eaf979e95fa0.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1636 wrote to memory of 4584 1636 cec81d5e05615fd21e42eaf979e95fa0.exe 84 PID 1636 wrote to memory of 4584 1636 cec81d5e05615fd21e42eaf979e95fa0.exe 84 PID 1636 wrote to memory of 4584 1636 cec81d5e05615fd21e42eaf979e95fa0.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\cec81d5e05615fd21e42eaf979e95fa0.exe"C:\Users\Admin\AppData\Local\Temp\cec81d5e05615fd21e42eaf979e95fa0.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\cec81d5e05615fd21e42eaf979e95fa0.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\cec81d5e05615fd21e42eaf979e95fa0.exe"2⤵
- Executes dropped EXE
PID:4584
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\cec81d5e05615fd21e42eaf979e95fa0.exe
- Size 1.8MB
- SHA256 44ac698b0a5dae55c224dd21a38ce2e49b830c5bbebc5ee6457d38f86e658d3a
- MD5 348b796808f11330ed32b441f76429e3
- SHA1 ec10fd14b8ee0050cdcf98ba50bca488646d58e6
- SHA512 2dc9bb125b8a1afbb4917513d6bd55042a8dd389859a97188dc2d3b91130611a85f8491cc0024f3119f10a832fc7771cfb08ccba4d38cd9ec4fca577dc9bbb81
- SSDEEP 49152:YQR6QAuAMLVImaAfqTTCEyNCSay7ATGg1ylle5oUb2:Yo6QLAMZoCEyNCfLQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\cec81d5e05615fd21e42eaf979e95fa0.exe
- Size 1.8MB
- SHA256 44ac698b0a5dae55c224dd21a38ce2e49b830c5bbebc5ee6457d38f86e658d3a
- MD5 348b796808f11330ed32b441f76429e3
- SHA1 ec10fd14b8ee0050cdcf98ba50bca488646d58e6
- SHA512 2dc9bb125b8a1afbb4917513d6bd55042a8dd389859a97188dc2d3b91130611a85f8491cc0024f3119f10a832fc7771cfb08ccba4d38cd9ec4fca577dc9bbb81
- SSDEEP 49152:YQR6QAuAMLVImaAfqTTCEyNCSay7ATGg1ylle5oUb2:Yo6QLAMZoCEyNCfLQ
- MD5 SHA1 SHA512 SSDEEP