Overview

overview

10

Static

static

10

4cbac922af...f2.exe

windows7-x64

10

4cbac922af...f2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2022, 07:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
  • Size 182KB
  • Sample221223-jdgcfagb22
  • SHA256 4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
neshtaevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\FILE RECOVERY.txt

Ransom Note
  • Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 25F913087E8250E2C3C7DD54 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �
URLs

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

  • http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

  • Detect Neshta payload 27 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
    "C:\Users\Admin\AppData\Local\Temp\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2220
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4776
          • C:\Windows\SysWOW64\sc.exe
            sc delete "MSSQLFDLauncher"
            5⤵
            • Launches sc.exe
            PID:1764
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
          4⤵
            PID:4692
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4812
          • C:\Windows\system32\vssadmin.exe
            C:\Windows\sysnative\vssadmin.exe delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:4732
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3972
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\System32\cmd.exe /c bcdedit /set {current} recoveryenabled no
            4⤵
              PID:2044
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1244

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ACROTE~1.EXE
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
            • Size 127KB
            • SHA256 3ed504ee3804fdd067bf02599ae9d41ef0f795f9f6f5ae1038e25578d0230f0a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            arh.exe
            • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
            • Size 125KB
            • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOBD5D~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE
            • Size 217KB
            • SHA256 c87fd5b223cb6dc716815b442b4964d4670a30b5c79f4fb9f1c3a65ec9072e5a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            GOOGLE~1.EXE
            • Path C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE
            • Size 231KB
            • SHA256 af9e01dab96c2a54e2751a0d703cc55fdcc5ac00c40f0be2e13fd85c09b66132
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DISABL~1.EXE
            • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
            • Size 191KB
            • SHA256 fba2b9270ade0ce80e8dfc5e3279db683324502f6103e451cd090c69da56415e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MICROS~1.EXE
            • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE
            • Size 241KB
            • SHA256 5dbab8e68c7a000fce8363b79a49b11e009edb3219b56fa78821f044af598767
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MicrosoftEdgeUpdate.exe
            • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe
            • Size 250KB
            • SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MSEDGE~2.EXE
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE
            • Size 1.6MB
            • SHA256 162fa0da2e043f0939b8956baf4ed10e71390c2c0574ac94516b64636bcbb0f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PWAHEL~1.EXE
            • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
            • Size 1.1MB
            • SHA256 9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            UNINST~1.EXE
            • Path C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
            • Size 129KB
            • SHA256 c8ef54853df3a3b64aa4b1ecfb91615d616c7ff998589e5a3434118611ad2a24
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            INTEGR~1.EXE
            • Path C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
            • Size 6.7MB
            • SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
            • Size 485KB
            • SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VC_RED~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
            • Size 674KB
            • SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VC_RED~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
            • Size 674KB
            • SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
            • Size 495KB
            • SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
            • Size 485KB
            • SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VCREDI~1.EXE
            • Path C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
            • Size 495KB
            • SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FILECO~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILECO~1.EXE
            • Size 499KB
            • SHA256 a811042693bc2b31be7e3f454b12312f67bc97f2b15335a97e8d8f2ba0a6b255
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FILESY~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
            • Size 293KB
            • SHA256 d2767c9c52835f19f6695c604081bf03cdd772a3731cd2e320d9db5e477d8af7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ONEDRI~1.EXE
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE
            • Size 2.4MB
            • SHA256 8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OneDrive.exe
            • Path C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
            • Size 1.6MB
            • SHA256 0a023355d1cc0a2348475d63aaf6aa0521d11e12a5c70102d7b3ebde092849e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3582-490\4cbac922af3cfaba5fa7a3251bd05337bffd9ed0ada77c55bb4f78a041f4ebf2.exe
            • Size 141KB
            • SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tmp5023.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
            • Size 8B
            • SHA256 eac31111d5b6a9427a84013f51bb4bb75ed262089384dcd170438e7744a0fac8
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 43B
            • SHA256 e67c0acc933ecc138d6c6bef08698c7e2c01f2a680e4292aae54a84f833aa062
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 43B
            • SHA256 e67c0acc933ecc138d6c6bef08698c7e2c01f2a680e4292aae54a84f833aa062
            • MD5 SHA1 SHA512
            Submit Download

            directx.sys
            • Path C:\Windows\directx.sys
            • Size 29B
            • SHA256 97d597793ec8307b71f3cfb8a6754be45bf4c548914367f4dc9af315c3a93d9b
            • MD5 SHA1 SHA512
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            svchost.com
            • Path C:\Windows\svchost.com
            • Size 40KB
            • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OFFICE~1.EXE
            • Path C:\odt\OFFICE~1.EXE
            • Size 5.1MB
            • SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download