neshta | 15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a

Analysis

max time kernel
205s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
Size

352KB
MD5

195d3d302d1b26fcdcd8e955bdfb9a35
SHA1

db2464c6d6c5e113f968b88e258b66e19dd7755f
SHA256

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a
SHA512

e22b960135bf78376edae983b0a0d8afe9d3733cca3179f739f7aaad9c2cc1627d849cbb505c8f0545ccac966aabd77cd9475ae1024e74391a7f7fc4b448ac1a
SSDEEP

6144:k9W1DrcgbeDhFJAMBkRzU+ojvIElX+p8EZZDm+96:vPcgq1FGMiRzfojvIppYq6

Score

10^/10

neshta evasion persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 18 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	family_neshta
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	family_neshta
C:\PROGRA~2\Google\Update\DISABL~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	family_neshta
C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{9B826~1\MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe	family_neshta
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe	family_neshta
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe	family_neshta
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 3 IoCs

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exesvchost.comsystem.exe

pid process

1608 15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
5048 svchost.com
2288 system.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

432 netsh.exe

pid	process
1608	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
5048	svchost.com
2288	system.exe

pid	process
432	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

Drops startup file 2 IoCs

Processes:

system.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38a365d793b3ef92f79564a9e72ad028.exe	system.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38a365d793b3ef92f79564a9e72ad028.exe	system.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

system.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38a365d793b3ef92f79564a9e72ad028 = "\"C:\\Users\\Admin\\system.exe\" .."	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38a365d793b3ef92f79564a9e72ad028 = "\"C:\\Users\\Admin\\system.exe\" .."	system.exe

Drops file in Program Files directory 64 IoCs

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exesvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	svchost.com
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

Drops file in Windows directory 5 IoCs

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exesvchost.com15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

system.exe

pid	process
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe
2288	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

system.exe

description pid process

Token: SeDebugPrivilege 2288 system.exe

description	pid	process
Token: SeDebugPrivilege	2288	system.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exesvchost.comsystem.exe

description	pid	process	target process
PID 3436 wrote to memory of 1608	3436	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
PID 3436 wrote to memory of 1608	3436	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
PID 1608 wrote to memory of 5048	1608	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe	svchost.com
PID 1608 wrote to memory of 5048	1608	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe	svchost.com
PID 1608 wrote to memory of 5048	1608	15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe	svchost.com
PID 5048 wrote to memory of 2288	5048	svchost.com	system.exe
PID 5048 wrote to memory of 2288	5048	svchost.com	system.exe
PID 2288 wrote to memory of 432	2288	system.exe	netsh.exe
PID 2288 wrote to memory of 432	2288	system.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
"C:\Users\Admin\AppData\Local\Temp\15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3436

C:\Users\Admin\AppData\Local\Temp\3582-490\15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\system.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5048

C:\Users\Admin\system.exe
C:\Users\Admin\system.exe
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\system.exe" "system.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe
Filesize
982KB

MD5
4e8c731e3175d6d2f5085fe55974e1db

SHA1
74604823bd1e5af86d66e4986c1203f2bf26e657

SHA256
8a8d0905d868bc8b3bbd3545de42b459b3b517bb874365f911ff05ae71f90325

SHA512
a058948f7a82ca4c14ea41527c66918e7737776f7af65b00888f3c39de416397821861ba4e77cdb8a738bc0136462d1256bc6447f0d105d929831a2b47c87485

Download Submit
C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
Filesize
664KB

MD5
522c12509a9fde92565e673f2f47a0b9

SHA1
3cb06efb8b369eb72c55a83f2e89732a924a96f8

SHA256
5cbea72c5565c342e07edfc8902eeea7cfb450362f2ce0cb7b1b184dbf72ef64

SHA512
b112b9d568cf9c14cd289b1dc9dc173d800b0b70c63221cbcc326f6727d56027dcc7355599a0bc9a4c6d9abb39281456cc5a138f625147efef9819ebee9fea35

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
Filesize
178KB

MD5
f1e707e6e6a6bd544e1f4c04dae68f0b

SHA1
7328d139b7378264796838c9b7ffedc233589cde

SHA256
98764ffe0366a01ae235033054556e52d6061633dfb6fba210940c89500809d2

SHA512
18a16bdb76f2749ed318873122b6e6374449d20cec4ae6a9fa1368a830a17064be266840dc89fe587ee0667b1d5b2942e32947a6e429109900816179ecdfe9cf

Download Submit
C:\PROGRA~2\Google\Update\DISABL~1.EXE
Filesize
231KB

MD5
2a226fd810c5ce7b825ff7982bc22a0b

SHA1
58be5cb790336a8e751e91b1702a87fc0521a1d8

SHA256
af9e01dab96c2a54e2751a0d703cc55fdcc5ac00c40f0be2e13fd85c09b66132

SHA512
f122ce37b07871b88e322b0ca2e42f3170704d4165167d6d7b02883da9d2be5d2d62bdbd9f7e18d1c0c5e60e9e707a3b64ddb99150c99028333818dfa769deeb

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE
Filesize
179KB

MD5
c3faf2d052b6f1d2a4950004278e5e76

SHA1
f58531434952cc7ba2c9f55b4ad03beec9cd1ffb

SHA256
9507ade9fdc6a4195cbb1fc18864d4f9feaee0079183b12215f58a3d31b027fe

SHA512
70510254cde82024a86e4053e72afe523674efea79346e10beed328070b522940d1dd01dff5c19da23100c734d7edf77e762702535e2c58bc2952557dac38a0f

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{9B826~1\MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe
Filesize
1.6MB

MD5
c4f49ac29e45d7ea05722724437f20fd

SHA1
147da727d43c478757de1d0d1f6750a6d6901c9a

SHA256
b3800a972b7ce122a7ae264da0ab65f0448c6250561c3021a3859fcdf5af59b4

SHA512
7d3cb239bc7da5458416e42246f7dfa09e2ca188a1f42c85429b78aa12671c5512435560aa62ccc84cdeebb1b64f2fef0f2af320b634177659372305bf11af85

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
Filesize
534KB

MD5
3bf259392097b2c212b621a52da03706

SHA1
c740b063803008e3d4bab51b8e2719c1f4027bf9

SHA256
79538fa3a6cf33b989d43e7311de4d7b0e1a99b60964e3acc00fa3cb49ff8160

SHA512
186a81ec6cfa4c6dbcb2dc51cbd647bf44328077b58575fafab920303ccf259322cd31fccc0bb23418293f1b88d7f21ab3f0d8e3f9af7db4b5d3f7c8978c7934

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
Filesize
6.7MB

MD5
63dc05e27a0b43bf25f151751b481b8c

SHA1
b20321483dac62bce0aa0cef1d193d247747e189

SHA256
7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

SHA512
374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE
Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
Filesize
674KB

MD5
7656a9e9eca746b0b193804f287d4e9c

SHA1
7bd62dfcf9012b8ddb7209709101614a0be4efc1

SHA256
afa2810184786e0a5036f25886bb2e1049a916c54137bf2a79f79154d01195bb

SHA512
e880691a38474ae77be32db3da42cfcc804bc0610883cf5ea8911a7d333e47ec4335499b24834e4ab1cacd0d14185d916669a452d68c43bce90f7b975479ec06

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE
Filesize
715KB

MD5
4cf3954a39b7e27f364cbb5e58a3a957

SHA1
4498a5dea907da2b85e30bf6a1ebddfbaba2eb18

SHA256
f24a6d80aff3ee9ee65a609376d1aa3fdb3a034847ebbc0e4e65ff20ab0893fb

SHA512
d7dd8c5ad15dda561ae309fbf18e5ad2e852e951e937ea062cc0cb035df74ecb5a9aa636c6813aef37271268cedb1b3c5d39a8b6519fd54f5346445a2a9ef57d

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE
Filesize
536KB

MD5
31685b921fcd439185495e2bdc8c5ebf

SHA1
5d171dd1f2fc2ad55bde2e3c16a58abff07ae636

SHA256
4798142637154af13e3ed0e0b508459cf71d2dc1ae2f80f8439d14975617e05c

SHA512
04a414a89e02f9541b0728c82c38f0c64af1e95074f00699a48c82a5e99f4a6488fd7914ff1fa7a5bf383ce85d2dceab7f686d4ee5344ab36e7b9f13ceec9e7f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
Filesize
525KB

MD5
f6636e7fd493f59a5511f08894bba153

SHA1
3618061817fdf1155acc0c99b7639b30e3b6936c

SHA256
61720d294189141b74631299911d91874aa02e67096a47cfaf56ef03f568bd33

SHA512
bd2ae751a37b4c065f0d7f7f7ec19785c1552dfaa4818fdb213fffcf90b7951886131a2b5d7aad843f714be418383fcf09ba1d9548bdbf38fa3d304a092a33d1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
Filesize
536KB

MD5
3e8de969e12cd5e6292489a12a9834b6

SHA1
285b89585a09ead4affa32ecaaa842bc51d53ad5

SHA256
7a25fc3b1ce0f1d06a84dd344c8f5a6c4604732f7d13a8aaad504c4376b305cf

SHA512
b14a5936181a1d8c0f966d969a049254238bf1eacdb1da952c2dc084d5d6dcd5d611d2d058d4c00d6384c20046deef5e74ea865c0062bb0761a391a1eaf1640e

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
Filesize
1.7MB

MD5
e25ffbddf046809226ea738583fd29f9

SHA1
ebda60d1f49cd1c2559d6c0f0a760dac7f38ce98

SHA256
91630469f3d18ebf1be43522b6dcb6547c3b67ab7a17a246e1b2122628dfcd80

SHA512
4417cba81c77c2a60e448b69dc615574ed4862fd97af014ebdf3ffbdde8a6c9bc32aca4881f59037f908a67b674d9e49b817fc1e6865e8f08e374f36baade101

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
Filesize
311KB

MD5
a9da88e876bdc10476ede5d97512d3ed

SHA1
708a54690955642c8ee53547d470ccf7732170cd

SHA256
a6b792153ab8afdc04ee567db62c9df9549019d95e4706df9b00948c65d9b8ca

SHA512
b2465abedfeb40664a7e1ec2814ceae9e17cf7e6319844e6bc724a91d9581076469c64bc5aace2e991fba6812a18592e31646df0abbf105baeddad66f384dfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\15d24e4e0a2ec8e7b23736e331ebcb3ff7dc735babeb5f0610a06e868e51345a.exe
Filesize
311KB

MD5
a9da88e876bdc10476ede5d97512d3ed

SHA1
708a54690955642c8ee53547d470ccf7732170cd

SHA256
a6b792153ab8afdc04ee567db62c9df9549019d95e4706df9b00948c65d9b8ca

SHA512
b2465abedfeb40664a7e1ec2814ceae9e17cf7e6319844e6bc724a91d9581076469c64bc5aace2e991fba6812a18592e31646df0abbf105baeddad66f384dfd1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\38A365~1.EXE
Filesize
311KB

MD5
a9da88e876bdc10476ede5d97512d3ed

SHA1
708a54690955642c8ee53547d470ccf7732170cd

SHA256
a6b792153ab8afdc04ee567db62c9df9549019d95e4706df9b00948c65d9b8ca

SHA512
b2465abedfeb40664a7e1ec2814ceae9e17cf7e6319844e6bc724a91d9581076469c64bc5aace2e991fba6812a18592e31646df0abbf105baeddad66f384dfd1

Download Submit
C:\Users\Admin\system.exe
Filesize
311KB

MD5
a9da88e876bdc10476ede5d97512d3ed

SHA1
708a54690955642c8ee53547d470ccf7732170cd

SHA256
a6b792153ab8afdc04ee567db62c9df9549019d95e4706df9b00948c65d9b8ca

SHA512
b2465abedfeb40664a7e1ec2814ceae9e17cf7e6319844e6bc724a91d9581076469c64bc5aace2e991fba6812a18592e31646df0abbf105baeddad66f384dfd1

Download Submit
C:\Users\Admin\system.exe
Filesize
311KB

MD5
a9da88e876bdc10476ede5d97512d3ed

SHA1
708a54690955642c8ee53547d470ccf7732170cd

SHA256
a6b792153ab8afdc04ee567db62c9df9549019d95e4706df9b00948c65d9b8ca

SHA512
b2465abedfeb40664a7e1ec2814ceae9e17cf7e6319844e6bc724a91d9581076469c64bc5aace2e991fba6812a18592e31646df0abbf105baeddad66f384dfd1

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
C:\odt\OFFICE~1.EXE
Filesize
5.1MB

MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
memory/432-144-0x0000000000000000-mapping.dmp

Download
memory/1608-135-0x00007FF8CA490000-0x00007FF8CAEC6000-memory.dmp

Filesize
10.2MB

Download
memory/1608-132-0x0000000000000000-mapping.dmp

Download
memory/2288-142-0x00007FF8CA490000-0x00007FF8CAEC6000-memory.dmp

Filesize
10.2MB

Download
memory/2288-140-0x0000000000000000-mapping.dmp

Download
memory/5048-136-0x0000000000000000-mapping.dmp

Download