neshta | 7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6

General

Target

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
Size

899KB
MD5

1c171fab1e78fa70a01ee21e30975f0a
SHA1

f92145b312ec8d0ef148824b1fd6839f54b3f2ce
SHA256

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6
SHA512

9245e565bb4e8b8b78d0ad950c424df866343b3101e3a6a168abd1363173aa27c0605087c1090d5d8dee7d5ac5ea0bb0e00b189f9900d4d5e90408a16e8e7f6c
SSDEEP

24576:Q7v1HTNnk4A6EfEuCqwWFjSkI25Wc++kND7J:QxTNnk4EEuCqwDkjC+63J

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

pid process

2280 7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

pid	process
2280	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13169~1.31\MICROS~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~3.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~4.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MI9C33~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MIA062~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~2.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Drops file in Windows directory 1 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description ioc process

File opened for modification C:\Windows\svchost.com 7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Modifies registry class 1 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

description	pid	process	target process
PID 4460 wrote to memory of 2280	4460	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
PID 4460 wrote to memory of 2280	4460	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
PID 4460 wrote to memory of 2280	4460	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe	7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

C:\Users\Admin\AppData\Local\Temp\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
"C:\Users\Admin\AppData\Local\Temp\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe"
2⤵
- Executes dropped EXE
PID:2280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Filesize
858KB

MD5
8c00b0841860115c3b439bf40d19fbb9

SHA1
72445912e2c95fd9b42383a0b3e206cb5041fcb2

SHA256
50d1d74f015406fd5037a098848421c6887d09a8f14b115d10a7f1de24686244

SHA512
4f639351808989fe9609e5031272a4361e916bd553cffef2b39aa7890393d1db7febe6d62fe71caf2a3d15b84bad9f930a39a353cfd0475adde4b8bdbccd92c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\7d669f874028b993c8730dba69cb32e36aa665426fa8244a7e3d0fcab7b6b5a6.exe

Filesize
858KB

MD5
8c00b0841860115c3b439bf40d19fbb9

SHA1
72445912e2c95fd9b42383a0b3e206cb5041fcb2

SHA256
50d1d74f015406fd5037a098848421c6887d09a8f14b115d10a7f1de24686244

SHA512
4f639351808989fe9609e5031272a4361e916bd553cffef2b39aa7890393d1db7febe6d62fe71caf2a3d15b84bad9f930a39a353cfd0475adde4b8bdbccd92c7

Download Submit
memory/2280-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads