Analysis

  • max time kernel
    183s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 17:58

General

  • Target

    a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

  • Size

    970KB

  • MD5

    6e1bf2aa439c7b5aa10e19e4c8157820

  • SHA1

    cbad049711bc1e4abb2f2255d7836ce496664dce

  • SHA256

    a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2

  • SHA512

    22a4abafef557a61d37434d5718acf99ae2cfa40e203ff1917097b1b7b848b28e0ffa1dca8b600a577748cd2622b07248193526a8cefb42d056f3a9248997f76

  • SSDEEP

    12288:6xTsYsTsVbMB+QtIrA0X5pUCXVIBkd0/Qw7:6yHgeB+Q+U0X5pbOBkd0/b

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe
    "C:\Users\Admin\AppData\Local\Temp\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:944
    • C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe"
      2⤵
      • Executes dropped EXE
      PID:4840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 808
        3⤵
        • Program crash
        PID:3708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4840 -ip 4840
    1⤵
      PID:4104

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

            Filesize

            930KB

            MD5

            273371bb81fe2b644a5b501a20c7a485

            SHA1

            a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

            SHA256

            4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

            SHA512

            6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

          • C:\Users\Admin\AppData\Local\Temp\3582-490\a2df3791fce928acc910aa951a52e89ad3667f93cca9956ba9d3fa2b27c3d8d2.exe

            Filesize

            930KB

            MD5

            273371bb81fe2b644a5b501a20c7a485

            SHA1

            a87a66f9a69e5fa1ae5acd7787b67db1af589d2c

            SHA256

            4136d6fb3b815dfacc27230eb5242121a3b0f4a75b881e359a94a81fa71e1516

            SHA512

            6e7ab9bc5d10182397367b442d85d0c27b2f1f2786fc409ac3e02fbd2fc544f9060ffd621e2f3c80d952d02b840c2770b26770d1da43b109470f6ac407449d51

          • memory/4840-135-0x0000000000920000-0x0000000000A04000-memory.dmp

            Filesize

            912KB