neshta | 7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e

Analysis

max time kernel
150s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
Size

554KB
MD5

b64f3c2fbaa8844418d97fb813534140
SHA1

14ea90c0898faa048ee724cd49ecdf1179285252
SHA256

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e
SHA512

f628ec34e90be223e54b83c7afe0143ad1cb8811c2da481e94f0c625eebfd76fb3ec9338be65624be0f0eaf1db21a5ef9551892186b2ebaf055fb80174c9daaf
SSDEEP

12288:wggTSWAJR0p/StdpxHHF/XWs3KI/IDdFCPn:yTjAJR0JStdpxHHF/r/IDdEn

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

pid process

224 7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

pid	process
224	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

Drops file in Windows directory 1 IoCs

Processes:

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

description ioc process

File opened for modification C:\Windows\svchost.com 7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

Modifies registry class 1 IoCs

Processes:

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

description	pid	process	target process
PID 2908 wrote to memory of 224	2908	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
PID 2908 wrote to memory of 224	2908	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
PID 2908 wrote to memory of 224	2908	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe	7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe

C:\Users\Admin\AppData\Local\Temp\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
"C:\Users\Admin\AppData\Local\Temp\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe"
2⤵
- Executes dropped EXE
PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
Filesize
513KB

MD5
35fba027e38455ff3d915dfd2b7e6f88

SHA1
d9ab135537398bfc845ae953dad1090c47f15371

SHA256
e4a5023310e140172f53e7a8b5639a17572a6b7f1f775382f43faa96b0818ca7

SHA512
1a8748235b610a89a0b3871ce63f7e4f65ed8815d80587153e3a8256a086f561164a09bf312d905b2126de5c423c7ffdeddfd606efec85f49a4a8b56ed16fd51

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\7e6fa755e21d031f09244f3c1559d9759f45105e746671ce6efc11676c0e249e.exe
Filesize
513KB

MD5
35fba027e38455ff3d915dfd2b7e6f88

SHA1
d9ab135537398bfc845ae953dad1090c47f15371

SHA256
e4a5023310e140172f53e7a8b5639a17572a6b7f1f775382f43faa96b0818ca7

SHA512
1a8748235b610a89a0b3871ce63f7e4f65ed8815d80587153e3a8256a086f561164a09bf312d905b2126de5c423c7ffdeddfd606efec85f49a4a8b56ed16fd51

Download Submit
memory/224-132-0x0000000000000000-mapping.dmp

Download