neshta | 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9

General

Target

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Size

302KB
MD5

2f07126494c0a0b3b80c80bb12f88fe4
SHA1

99a22938c2e480ce35c9bb39fb873f297ebdf009
SHA256

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9
SHA512

609cb343cd4a15192aabdcc929f6c813024b9a566b44d77ecd098062c372494e829d492c761a5fb573a135790a130c0cddd592f7f299e2063854d5c414bb43e3
SSDEEP

6144:PuRPRdHC+lVTZawWU3gs2OqHjTNcQOlkqCm6D2PYAGK8YE:7YBZV3gOSPnKpE

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exesetup.exe

pid process

4608 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
4572 setup.exe

pid	process
4608	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
4572	setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 64 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Drops file in Windows directory 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description ioc process

File opened for modification C:\Windows\svchost.com 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exemsedge.exemsedge.exe

pid process

4608 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
4188 msedge.exe
4188 msedge.exe
2804 msedge.exe
2804 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

2804 msedge.exe
2804 msedge.exe
2804 msedge.exe
2804 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

description pid process

Token: SeDebugPrivilege 4608 382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2804 msedge.exe
2804 msedge.exe
2804 msedge.exe

pid	process
4608	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
4188	msedge.exe
4188	msedge.exe
2804	msedge.exe
2804	msedge.exe

pid	process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

description	pid	process
Token: SeDebugPrivilege	4608	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe

pid	process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exemsedge.exe

description	pid	process	target process
PID 872 wrote to memory of 4608	872	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 872 wrote to memory of 4608	872	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 872 wrote to memory of 4608	872	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
PID 4608 wrote to memory of 2804	4608	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	msedge.exe
PID 4608 wrote to memory of 2804	4608	382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe	msedge.exe
PID 2804 wrote to memory of 4556	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4556	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4164	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4188	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 4188	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe
PID 2804 wrote to memory of 1820	2804	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
"C:\Users\Admin\AppData\Local\Temp\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:872

C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://oi62.tinypic.com/11rc2zb.jpg
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd4cb746f8,0x7ffd4cb74708,0x7ffd4cb74718
4⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
4⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
4⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
4⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
4⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 /prefetch:8
4⤵
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5544 /prefetch:8
4⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
4⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
4⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4795688290490938061,12336058657046549256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
4⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Executes dropped EXE
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
Filesize
1.2MB

MD5
08a79dd66852e5b47051e2fd1c00646d

SHA1
0a9a1229c218683915f8a8c6e0cb5b7ec138bad8

SHA256
59e2a7c4e9b1f7aa9017fc7e0a77c00e1e7d06e67c47549f7915eae3e1292f4c

SHA512
b38597195fcbd4ea5876bf138fc518eba5789398a31e6664de0f5be9fe04fdeae382b1a483fe0007ae2ef708028e4ee9935fc75ce04f4c030610045ce7b6de3f

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
Filesize
1.2MB

MD5
08a79dd66852e5b47051e2fd1c00646d

SHA1
0a9a1229c218683915f8a8c6e0cb5b7ec138bad8

SHA256
59e2a7c4e9b1f7aa9017fc7e0a77c00e1e7d06e67c47549f7915eae3e1292f4c

SHA512
b38597195fcbd4ea5876bf138fc518eba5789398a31e6664de0f5be9fe04fdeae382b1a483fe0007ae2ef708028e4ee9935fc75ce04f4c030610045ce7b6de3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Filesize
261KB

MD5
58985d0222396c6d8c77a90191b6e4fa

SHA1
c5c4c51732c58e4918ae05c1741d3b4d2aa34bb1

SHA256
d1ec56809f7eacff3ebe60865519f141a2eb5b51f2a8bcce053713d06fec9c28

SHA512
2efff24562a31bf8a20720bbc63436bd0ba0018492cdaf27db96e7281e8cb67d1974e95ec7728911791915613e010968bda3d757d05da323cb765619b00916c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\382887e2d15ab9ad6f8783a0ce01d6eafc513c8b4533447bbb400e1c5ee141b9.exe
Filesize
261KB

MD5
58985d0222396c6d8c77a90191b6e4fa

SHA1
c5c4c51732c58e4918ae05c1741d3b4d2aa34bb1

SHA256
d1ec56809f7eacff3ebe60865519f141a2eb5b51f2a8bcce053713d06fec9c28

SHA512
2efff24562a31bf8a20720bbc63436bd0ba0018492cdaf27db96e7281e8cb67d1974e95ec7728911791915613e010968bda3d757d05da323cb765619b00916c6

Download Submit
\??\pipe\LOCAL\crashpad_2804_TDZIPSQFIKYKYWXL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1496-156-0x0000000000000000-mapping.dmp

Download
memory/1820-144-0x0000000000000000-mapping.dmp

Download
memory/2804-136-0x0000000000000000-mapping.dmp

Download
memory/3064-152-0x0000000000000000-mapping.dmp

Download
memory/3340-154-0x0000000000000000-mapping.dmp

Download
memory/3452-146-0x0000000000000000-mapping.dmp

Download
memory/3768-148-0x0000000000000000-mapping.dmp

Download
memory/4164-140-0x0000000000000000-mapping.dmp

Download
memory/4188-141-0x0000000000000000-mapping.dmp

Download
memory/4196-150-0x0000000000000000-mapping.dmp

Download
memory/4556-137-0x0000000000000000-mapping.dmp

Download
memory/4572-157-0x0000000000000000-mapping.dmp

Download
memory/4608-138-0x0000000073800000-0x0000000073DB1000-memory.dmp

Filesize
5.7MB

Download
memory/4608-135-0x0000000073800000-0x0000000073DB1000-memory.dmp

Filesize
5.7MB

Download
memory/4608-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads