Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-09-2022 13:23
General
-
Target
doc-file#98765678.exe
-
Size
865KB
-
MD5
5d31ff727ddebc94f37cff188c0fc3e7
-
SHA1
64b79513675b4421a1d6c36502a07d9395d3aa24
-
SHA256
72a9187d68249e63f4562b466013c4a77b622621a229249874572e667fb80b2e
-
SHA512
0bd7cd4e3cd6ec25908c75ead3a8e6ebe46258115b7a110f449b096eb009233a89474e8cde4eb281bf11c1e1cd85f4af643c6a4928e574fc2c25bd343e4f16e6
-
SSDEEP
12288:zAtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4FhozEJ1888888888888W88888888W:zANzCtUpQ9WWPBSSRMTEpMNJj
Malware Config
Signatures
-
Detect Neshta payload 2 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc-file#98765678.exe"C:\Users\Admin\AppData\Local\Temp\doc-file#98765678.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\doc-file#98765678.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\doc-file#98765678.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824KB
MD5ef022abab9148a89477c6ef69986245e
SHA13594bf72178d5b25d1d1ea961066c66a351d778b
SHA256ee541918a4c3b9b7e84e29dae647d56fcdb64daa62a369a827ee629fe9352f1a
SHA5125ca980cb99ef842fc02ff862db5b026a61bafd4a73b5c6f081632fa12d322fe197aa80d2e0e20c7dee1e135e235cbaa5e4326b7a894da93119250c89fbfa2321
-
Filesize
824KB
MD5ef022abab9148a89477c6ef69986245e
SHA13594bf72178d5b25d1d1ea961066c66a351d778b
SHA256ee541918a4c3b9b7e84e29dae647d56fcdb64daa62a369a827ee629fe9352f1a
SHA5125ca980cb99ef842fc02ff862db5b026a61bafd4a73b5c6f081632fa12d322fe197aa80d2e0e20c7dee1e135e235cbaa5e4326b7a894da93119250c89fbfa2321
-
Filesize
865KB
MD5504020947f049b4f976487d384b6511c
SHA123c39daf9f5a271af36378917c0a940b74385c83
SHA25604a80b44617d3aeaedaaec43b8facd7b3adb7768aeec0eb329034db622b9ee07
SHA512b69aa72200a5b74145054061276543552b34fe8ce0807d320e895422ae81559d648ce03995f688601c87f701e3a429188fe16132e4b96826026b2ff525828e98
-
Filesize
865KB
MD55d31ff727ddebc94f37cff188c0fc3e7
SHA164b79513675b4421a1d6c36502a07d9395d3aa24
SHA25672a9187d68249e63f4562b466013c4a77b622621a229249874572e667fb80b2e
SHA5120bd7cd4e3cd6ec25908c75ead3a8e6ebe46258115b7a110f449b096eb009233a89474e8cde4eb281bf11c1e1cd85f4af643c6a4928e574fc2c25bd343e4f16e6
-
Filesize
5.1MB
MD502c3d242fe142b0eabec69211b34bc55
SHA1ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e
SHA2562a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
SHA5120efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099
-
-
Filesize
876KB
-
Filesize
876KB