neshta | 76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9

General

Target

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
Size

40KB
MD5

50e1b5d9a261def5f3596ebc127541c3
SHA1

66ca98d6319c5d97a942b4429f23032d468cd49e
SHA256

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9
SHA512

ad17469950f2aacd8db30e905e49c997daee7a757293bbc05d0a65f4e54eab4c9e6f51843ebec4b927cbd3e5ce1dcd13a12a2f39843ba42934891995dc8f055c
SSDEEP

768:myxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJX8:RxqjQ+P04wsmJCg8

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Drops file in Program Files directory 64 IoCs

Processes:

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~4.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MI9C33~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13171~1.37\MICROS~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~2.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MICROS~3.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MIA062~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13171~1.37\MI391D~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

Drops file in Windows directory 1 IoCs

Processes:

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

description ioc process

File opened for modification C:\Windows\svchost.com 76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

Modifies registry class 1 IoCs

Processes:

76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe

C:\Users\Admin\AppData\Local\Temp\76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe
"C:\Users\Admin\AppData\Local\Temp\76259e55110e967c4dd1ce51e14ff0e7f4a8560a06c82e3c5a044db84dd592d9.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads