Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
12-10-2022 09:57
General
-
Target
2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe
-
Size
97KB
-
MD5
54c2b90fd9364cd39cecff8ab112b825
-
SHA1
96c0c98dcce84e3bbec643083ce675664173bfd2
-
SHA256
2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba
-
SHA512
2e243d990243a80908531f3dc8910df796be6c87b964fbd84192e8161463d4460b552b5136379e789741f80abddfe77e77e81c4dcca9057881959a0d9dc1f3ce
-
SSDEEP
1536:JxqjQ+P04wsmJCGf0sKkr0EU5NeRBl5PT/rx1mzwRMSTdLpJUM:sr85CG07QRrmzwR5Jx
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Loads dropped DLL 12 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 10 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe"C:\Users\Admin\AppData\Local\Temp\2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2491121455a502cad9422ca91297c6fb89acb84ef8c26cc1a8bcebf694f9f5ba.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BAB2DED0D4CED0866E8B960EB7D0DCA32⤵
- Loads dropped DLL
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding A3242E4BC7F185050F27CA89F829DF8E2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD5dd88cd2e2873a04f1b44b81e2a40ba87
SHA1ee29ca31f99fa067cde7d35cec7e64cbb9111650
SHA25683cd4395b42a80615a1267bb2a2e71dd8953f253f3d50b1d2020c3bc975d0678
SHA512580c8d2ef4a58ef64885455b4d92dea544e7e56181629cd0146433990f7d8e94008c1b7ab8c4f0dae5ed9b6f14208b5c70f48d0c2168b3258a50ade2ec094fe6
-
Filesize
1.1MB
MD5a8caf6e9fe85e20c76bcd41e23481d28
SHA1bf0ace184cf72cd44abeafa80234290e8912dfe9
SHA25630aa4e4097dd7f51fbdf7ee0a34d17e01a8feb0b677421ff704f85d8485b267b
SHA512988228d5bfd7668eb744d102e2405ad1c9de8b9cec16fe75f97c1db1d158f0aafca94fa842b0a3420c2a1812a44f5739c5b2e4f1ac0a36c2d839bce4a56758e5
-
Filesize
859KB
MD5e13383b5b1f1eeadbc837a8c07ca8911
SHA13c3dce72323c4262962921dce61d8106f1578570
SHA25651e4db873d14549cfc617f0a48ecfd06c6ec885917493e1e62476db55f6faed1
SHA512dca8d18b24c267fdd8a66309ebfcdba0bb54885e7135508c9460bcb61b8dfb24a29cc2b9ad635a76a4d3ec34759869d93060fbda0ed04318106841c9b1c2ec7a
-
Filesize
547KB
MD5b70e12a99078046b5137685709b549ab
SHA105a8ca2e6bb4769b81f99d197a26d33201c1f726
SHA256472490b5d497151edb0ce65fec9f236a262a39a17f5340d2f94de49e2d2c4a24
SHA51276059ab7a263a13d2fb44d1eaaf42c6b5d6cbc6f3617f9d8aa1f304e43a9e8e8e287f7d5c32284165e32ff3c22bae06e7ac25174161490063120ea27628d67c2
-
Filesize
56KB
MD50315ae9ac71bb7366887ccefd4ae80aa
SHA1a60fb81131fc39e52e1854d0dc9ca358bb1d9983
SHA256afd2d4ec293f67be46f6ad8bca6150867de652be66115ddd469ba8720fda40a7
SHA512b56f195532fd835d72e207d5b2032b43b76c03c3d6c0cbd21d9546ff81b21abd41dd4c85888c1c4c24c7048dca61c1a63488ae9a4b90d5801389e37612165a23
-
Filesize
56KB
MD50315ae9ac71bb7366887ccefd4ae80aa
SHA1a60fb81131fc39e52e1854d0dc9ca358bb1d9983
SHA256afd2d4ec293f67be46f6ad8bca6150867de652be66115ddd469ba8720fda40a7
SHA512b56f195532fd835d72e207d5b2032b43b76c03c3d6c0cbd21d9546ff81b21abd41dd4c85888c1c4c24c7048dca61c1a63488ae9a4b90d5801389e37612165a23
-
Filesize
56KB
MD50315ae9ac71bb7366887ccefd4ae80aa
SHA1a60fb81131fc39e52e1854d0dc9ca358bb1d9983
SHA256afd2d4ec293f67be46f6ad8bca6150867de652be66115ddd469ba8720fda40a7
SHA512b56f195532fd835d72e207d5b2032b43b76c03c3d6c0cbd21d9546ff81b21abd41dd4c85888c1c4c24c7048dca61c1a63488ae9a4b90d5801389e37612165a23
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
953KB
MD52f4759c23abcd639ac3ca7f8fa9480ac
SHA19a3fece585fa01b7b941e124ead0c39c8ce9bc7c
SHA2566d66fa59407862e0fddfcb36472fe810eb308653321ca0e374ac870f9aa8cec6
SHA5126ab14d6a8d3e9a751d68133e734cc804de2b50a7ef223d484d0f727cdfbd00d48f6e0666c3b86a0daf9ca42c0b726f6c2a088e5bb32c993748abfea7b5904ec6
-
Filesize
953KB
MD52f4759c23abcd639ac3ca7f8fa9480ac
SHA19a3fece585fa01b7b941e124ead0c39c8ce9bc7c
SHA2566d66fa59407862e0fddfcb36472fe810eb308653321ca0e374ac870f9aa8cec6
SHA5126ab14d6a8d3e9a751d68133e734cc804de2b50a7ef223d484d0f727cdfbd00d48f6e0666c3b86a0daf9ca42c0b726f6c2a088e5bb32c993748abfea7b5904ec6
-
Filesize
56KB
MD50315ae9ac71bb7366887ccefd4ae80aa
SHA1a60fb81131fc39e52e1854d0dc9ca358bb1d9983
SHA256afd2d4ec293f67be46f6ad8bca6150867de652be66115ddd469ba8720fda40a7
SHA512b56f195532fd835d72e207d5b2032b43b76c03c3d6c0cbd21d9546ff81b21abd41dd4c85888c1c4c24c7048dca61c1a63488ae9a4b90d5801389e37612165a23
-
Filesize
56KB
MD50315ae9ac71bb7366887ccefd4ae80aa
SHA1a60fb81131fc39e52e1854d0dc9ca358bb1d9983
SHA256afd2d4ec293f67be46f6ad8bca6150867de652be66115ddd469ba8720fda40a7
SHA512b56f195532fd835d72e207d5b2032b43b76c03c3d6c0cbd21d9546ff81b21abd41dd4c85888c1c4c24c7048dca61c1a63488ae9a4b90d5801389e37612165a23
-
Filesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
Filesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
Filesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
-
Filesize
8KB
-
-
Filesize
8KB
-
-
-
-
-
-
-
-
-
-