Overview

overview

10

Static

static

10

4cbac922af...f2.exe

windows7-x64

10

4cbac922af...f2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2022, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
  • Size 182KB
  • Sample221223-janmcabc2s
  • SHA256 4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtaevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\FILE RECOVERY.txt

Ransom Note
  • Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 3E8915403CD9129BA1C6B047 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �
URLs

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

  • Detect Neshta payload 29 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
    "C:\Users\Admin\AppData\Local\Temp\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2828
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\system32\vssadmin.exe
          C:\Windows\sysnative\vssadmin.exe delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:4404
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
          4⤵
            PID:4824
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3956
            • C:\Windows\SysWOW64\sc.exe
              sc delete "MSSQLFDLauncher"
              5⤵
              • Launches sc.exe
              PID:3388
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4620
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\System32\cmd.exe /c bcdedit /set {current} recoveryenabled no
      1⤵
        PID:996
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2576

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ACROTE~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
            • Size 86KB
            • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            arh.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
            • Size 125KB
            • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            64BITM~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
            • Size 278KB
            • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADOBEA~1.EXE
            • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
            • Size 454KB
            • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jusched.exe
            • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
            • Size 623KB
            • SHA256 c6b7f9119cf867951f007c5468f75eb4dca59c7eedeb0afdd8ad9d5b9606e759
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~3.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE
            • Size 326KB
            • SHA256 56977618a0fbd66c0ef0ca042290dfe464f4ad5b4b737a4b9db47631a7178f13
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe
            • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\Install\{9B826~1\MicrosoftEdgeUpdateSetup_X86_1.3.165.21.exe
            • Size 1.6MB
            • SHA256 f2b8e29062f009a5c466343100b5aa28f6e8696de58fd5c48f610b494c070ae8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IE_TO_~1.EXE
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE
            • Size 509KB
            • SHA256 da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSEDGE~2.EXE
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE
            • Size 1.6MB
            • SHA256 162fa0da2e043f0939b8956baf4ed10e71390c2c0574ac94516b64636bcbb0f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSEDGE~1.EXE
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
            • Size 1.1MB
            • SHA256 34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PWAHEL~1.EXE
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
            • Size 1.1MB
            • SHA256 9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msedge.exe
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
            • Size 3.2MB
            • SHA256 2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            INTEGR~1.EXE
            • Path C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
            • Size 6.7MB
            • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
            • Size 485KB
            • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VC_RED~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
            • Size 674KB
            • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VC_RED~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
            • Size 674KB
            • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
            • Size 495KB
            • SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
            • Size 485KB
            • SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
            • Size 495KB
            • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FILECO~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILECO~1.EXE
            • Size 499KB
            • SHA256 a811042693bc2b31be7e3f454b12312f67bc97f2b15335a97e8d8f2ba0a6b255
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FILESY~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
            • Size 293KB
            • SHA256 d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONEDRI~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE
            • Size 2.4MB
            • SHA256 8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OneDrive.exe
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
            • Size 1.6MB
            • SHA256 0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tmp5023.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
            • Size 8B
            • SHA256 69f63e8337ef8477e696f83eb797e3249c7f7614ce1d71f01a634065eec6eeda
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 29B
            • SHA256 97d597793ec8307b71f3cfb8a6754be45bf4c548914367f4dc9af315c3a93d9b
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 29B
            • SHA256 97d597793ec8307b71f3cfb8a6754be45bf4c548914367f4dc9af315c3a93d9b
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 29B
            • SHA256 97d597793ec8307b71f3cfb8a6754be45bf4c548914367f4dc9af315c3a93d9b
            • MD5 SHA1 SHA512
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OFFICE~1.EXE
            • Path C:\odt\OFFICE~1.EXE
            • Size 5.1MB
            • SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download