neshta | 35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0

Analysis

max time kernel
203s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Size

430KB
MD5

f2fa726aa15a0bedc7de81cab3c2a5db
SHA1

a45ffdd8a301976719abe2f7400c0185b6662432
SHA256

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0
SHA512

9413137d3eeb19a84b02ed8249074e1f1e6d2ff791786f682bd28ca32b3323c2980292b828023e9d01f82237fb2132f2632344cb625c631230f2c98b1f1c5b9b
SSDEEP

6144:k9+feVjBpeExgVTFSXFoMc5RhCaL37mwww0JwwmSnvYqm9nxLW0Bs/kSTiOWGr9U:RZlPzCy37h8cW7Kcc

Score

10^/10

neshta persistence spyware stealer upx

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

pid process

1168 35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

pid	process
1168	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
C:\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
behavioral1/memory/1168-61-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	upx
behavioral1/memory/1168-71-0x0000000000400000-0x00000000004E8000-memory.dmp	upx

Loads dropped DLL 10 IoCs

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exeWerFault.exe

pid	process
1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
572	WerFault.exe
572	WerFault.exe
572	WerFault.exe
572	WerFault.exe
572	WerFault.exe
572	WerFault.exe
572	WerFault.exe
1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

Drops file in Windows directory 1 IoCs

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

description ioc process

File opened for modification C:\Windows\svchost.com 35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

572 1168 WerFault.exe 35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

pid	pid_target	process	target process
572	1168	WerFault.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

Modifies registry class 1 IoCs

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe

description	pid	process	target process
PID 1676 wrote to memory of 1168	1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
PID 1676 wrote to memory of 1168	1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
PID 1676 wrote to memory of 1168	1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
PID 1676 wrote to memory of 1168	1676	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
PID 1168 wrote to memory of 572	1168	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	WerFault.exe
PID 1168 wrote to memory of 572	1168	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	WerFault.exe
PID 1168 wrote to memory of 572	1168	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	WerFault.exe
PID 1168 wrote to memory of 572	1168	35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
"C:\Users\Admin\AppData\Local\Temp\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 220
3⤵
- Loads dropped DLL
- Program crash
PID:572

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\35f6969f46bdfad60514dbd8e64368e3b6d13e0ff92f21f649fab69a80fcd7b0.exe
Filesize
390KB

MD5
a7a1af091ae0999c280e9ec9c5dd9cca

SHA1
5e21140a5020370e2489f95f1868e1da6873c6e0

SHA256
c3e3ac828f51ea2c263904a398dd5bcfaf0d410793add67b08d738f054ea10a6

SHA512
c4f3cb0732c1197f652d94121bdb7bf7199a0bedb2eb4f90a4f627e9b9527381674048f029d57d4b11490774743a56b9698385eabf85e0c6da18bc95a29cb2ee

Download Submit
memory/572-63-0x0000000000000000-mapping.dmp

Download
memory/1168-61-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1168-71-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1168-57-0x0000000000000000-mapping.dmp

Download
memory/1676-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1676-60-0x0000000002740000-0x0000000002828000-memory.dmp

Filesize
928KB

Download
memory/1676-59-0x0000000002740000-0x0000000002828000-memory.dmp

Filesize
928KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads