neshta | 7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6

General

Target

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
Size

899KB
MD5

1c171fab1e78fa70a01ee21e30975f0a
SHA1

f92145b312ec8d0ef148824b1fd6839f54b3f2ce
SHA256

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6
SHA512

9245e565bb4e8b8b78d0ad950c424df866343b3101e3a6a168abd1363173aa27c0605087c1090d5d8dee7d5ac5ea0bb0e00b189f9900d4d5e90408a16e8e7f6c
SSDEEP

24576:Q7v1HTNnk4A6EfEuCqwWFjSkI25Wc++kND7J:QxTNnk4EEuCqwDkjC+63J

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

pid process

1940 7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

pid	process
1940	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Loads dropped DLL 2 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

pid	process
1716	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
1716	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Drops file in Windows directory 1 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description ioc process

File opened for modification C:\Windows\svchost.com 7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Modifies registry class 1 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	pid	process	target process
PID 1716 wrote to memory of 1940	1716	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
PID 1716 wrote to memory of 1940	1716	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
PID 1716 wrote to memory of 1940	1716	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
PID 1716 wrote to memory of 1940	1716	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

C:\Users\Admin\AppData\Local\Temp\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
"C:\Users\Admin\AppData\Local\Temp\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe"
2⤵
- Executes dropped EXE
PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Filesize
858KB

MD5
8c00b0841860115c3b439bf40d19fbb9

SHA1
72445912e2c95fd9b42383a0b3e206cb5041fcb2

SHA256
50d1d74f015406fd5037a098848421c6887d09a8f14b115d10a7f1de24686244

SHA512
4f639351808989fe9609e5031272a4361e916bd553cffef2b39aa7890393d1db7febe6d62fe71caf2a3d15b84bad9f930a39a353cfd0475adde4b8bdbccd92c7

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Filesize
858KB

MD5
8c00b0841860115c3b439bf40d19fbb9

SHA1
72445912e2c95fd9b42383a0b3e206cb5041fcb2

SHA256
50d1d74f015406fd5037a098848421c6887d09a8f14b115d10a7f1de24686244

SHA512
4f639351808989fe9609e5031272a4361e916bd553cffef2b39aa7890393d1db7febe6d62fe71caf2a3d15b84bad9f930a39a353cfd0475adde4b8bdbccd92c7

Download Submit
memory/1716-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads