neshta | 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9

General

Target

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Size

302KB
MD5

2f07126494c0a0b3b80c80bb12f88fe4
SHA1

99a22938c2e480ce35c9bb39fb873f297ebdf009
SHA256

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9
SHA512

609cb343cd4a15192aabdcc929f6c813024b9a566b44d77ecd098062c372494e829d492c761a5fb573a135790a130c0cddd592f7f299e2063854d5c414bb43e3
SSDEEP

6144:PuRPRdHC+lVTZawWU3gs2OqHjTNcQOlkqCm6D2PYAGK8YE:7YBZV3gOSPnKpE

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

pid process

1408 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

pid	process
1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Loads dropped DLL 2 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

pid	process
1628	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
1628	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Drops file in Windows directory 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description ioc process

File opened for modification C:\Windows\svchost.com 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{533E7320-6E64-11ED-8589-FE63F52BA449} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376326243"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000001a490dd5e5e5b14249f108b22d46222c68e5457be7cd83b0a96ad17868220be8000000000e8000000002000020000000d09938419480c7efd2548bca1a2c104c032dfb1b07b90ad38897459a0534e4fd20000000a0c695a62fe9f8bb769386cbebfaf5781a4b52496006b45a64476a49486be5e3400000004a3ee778f603f3ff71d91e0cb608f17675e8421e14692f8c80c17656c93ecb0557d70b402ad123661c61e769d56457d9c6880b07a8fdc05a6314bc1ba91e2118	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000b2c525addfb555308cf77b8b9effdca68b22c79c7a5f9b9e770c3cf743bc2646000000000e8000000002000020000000a2ab14b3b2994275768153d4f05955af4bfebdf6bd074bd6f8738a17d9f16c7b90000000c3aab65873220597ea25a1b59a063458bd2378f92a38cd0a002a4f94abcd8b151e1eaa3acd5aa82113ad661644e1bd2cbac60a96c6f70dfbd9a751bd3d7349d92f723aa23fec99b9e64619ee5608219824539257cc827e21596dbe45ef04f3be34e9a9371412f6f559a9c0db87d6aea0e0cac50b443cba6eafa6733d99fd8586a4da62ac32b4b02b26c8b125e6c957fd400000008fa1839bdd55f13eb5ff00092011bf285950e1ef8cc2b363f9d1ca7a9189fc2ccb779100356ebb1b34dc4cc6aee824ec6edbbcc2f9ecb1ccdc86dadcd08606e8	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50513d4b7102d901	iexplore.exe

Modifies registry class 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

pid process

1408 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description pid process

Token: SeDebugPrivilege 1408 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

432 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

432 iexplore.exe
432 iexplore.exe
1044 IEXPLORE.EXE
1044 IEXPLORE.EXE
1044 IEXPLORE.EXE
1044 IEXPLORE.EXE

pid	process
1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	pid	process
Token: SeDebugPrivilege	1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

pid	process
432	iexplore.exe

pid	process
432	iexplore.exe
432	iexplore.exe
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exeiexplore.exe

description	pid	process	target process
PID 1628 wrote to memory of 1408	1628	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 1628 wrote to memory of 1408	1628	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 1628 wrote to memory of 1408	1628	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 1628 wrote to memory of 1408	1628	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 1408 wrote to memory of 432	1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	iexplore.exe
PID 1408 wrote to memory of 432	1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	iexplore.exe
PID 1408 wrote to memory of 432	1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	iexplore.exe
PID 1408 wrote to memory of 432	1408	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	iexplore.exe
PID 432 wrote to memory of 1044	432	iexplore.exe	IEXPLORE.EXE
PID 432 wrote to memory of 1044	432	iexplore.exe	IEXPLORE.EXE
PID 432 wrote to memory of 1044	432	iexplore.exe	IEXPLORE.EXE
PID 432 wrote to memory of 1044	432	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
"C:\Users\Admin\AppData\Local\Temp\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://oi62.tinypic.com/11rc2zb.jpg
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:432 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t9o3c8r\imagestore.dat
Filesize
1KB

MD5
29e04c97a700ed784e602def59d03b70

SHA1
96e1e7af8fdb0bd859f8a4944c0d48a5a064b62f

SHA256
a8db4b10b6bc480f747b127625d78fb20afbfbcd5fd25d9355d0510e2739069a

SHA512
a4f286d664a40a5200c72671f97b27b65ea62eaafbc9aa9cabd655a6251f25ad338faca65b936805b4e057af2ddcffdd071b1d4c017d3c00318b83421d95639c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Filesize
261KB

MD5
58985d0222396c6d8c77a90191b6e4fa

SHA1
c5c4c51732c58e4918ae05c1741d3b4d2aa34bb1

SHA256
d1ec56809f7eacff3ebe60865519f141a2eb5b51f2a8bcce053713d06fec9c28

SHA512
2efff24562a31bf8a20720bbc63436bd0ba0018492cdaf27db96e7281e8cb67d1974e95ec7728911791915613e010968bda3d757d05da323cb765619b00916c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Filesize
261KB

MD5
58985d0222396c6d8c77a90191b6e4fa

SHA1
c5c4c51732c58e4918ae05c1741d3b4d2aa34bb1

SHA256
d1ec56809f7eacff3ebe60865519f141a2eb5b51f2a8bcce053713d06fec9c28

SHA512
2efff24562a31bf8a20720bbc63436bd0ba0018492cdaf27db96e7281e8cb67d1974e95ec7728911791915613e010968bda3d757d05da323cb765619b00916c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0YL5JIM5.txt
Filesize
608B

MD5
356ad24c1a876e3dd912760bb6686dbc

SHA1
01c907728e8fed55a90dc8faec9264cce6ff011a

SHA256
30c0615c4053788916b201f63b7720f1140d399cd0736572a20f137360871237

SHA512
83f2947b1764e6cfd1feda1ab659c71c1782b1c61ed8bbb7a4273a9985943b300ac037e982183707c76bbeec4366d28530645e65536e36a5b2bc009269733f3b

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Filesize
261KB

MD5
58985d0222396c6d8c77a90191b6e4fa

SHA1
c5c4c51732c58e4918ae05c1741d3b4d2aa34bb1

SHA256
d1ec56809f7eacff3ebe60865519f141a2eb5b51f2a8bcce053713d06fec9c28

SHA512
2efff24562a31bf8a20720bbc63436bd0ba0018492cdaf27db96e7281e8cb67d1974e95ec7728911791915613e010968bda3d757d05da323cb765619b00916c6

Download Submit
memory/1408-56-0x0000000000000000-mapping.dmp

Download
memory/1408-60-0x00000000744C0000-0x0000000074A6B000-memory.dmp

Filesize
5.7MB

Download
memory/1408-61-0x00000000744C0000-0x0000000074A6B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads