Overview

overview

10

Static

static

10

a97a31e1a6...50.exe

windows7-x64

10

a97a31e1a6...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05-04-2023 11:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe

  • Size

    96KB

  • MD5

    7f72105941c8f10b6260ef142b95965f

  • SHA1

    13024decb538649cec1f7f125907648c7ecf6b29

  • SHA256

    a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850

  • SHA512

    ca9a962b4d33721adfbec8a1c3988cf201c76eaffccbd2931fca4a9ef11007b664b3dda9c8cedfed170bcc716db0e84c313edd706ad8372e01b24b92ff4c97b9

  • SSDEEP

    1536:JxqjQ+P04wsmJCUrrdFyYv6gJZNeRBl5PT/rx1mzwRMSTdLpJ0M:sr85CUvdFq0QRrmzwR5JR

Score
10/10
neshtaphobosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Neshta payload 13 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
    "C:\Users\Admin\AppData\Local\Temp\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe"
        3⤵
        • Executes dropped EXE
        PID:668
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:732
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1908
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1376
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1716
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:1100
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          4⤵
          • Modifies Windows Firewall
          PID:1604
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          4⤵
          • Modifies Windows Firewall
          PID:1492
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:1256
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1192
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:212

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
          Filesize

          547KB

          MD5

          cf6c595d3e5e9667667af096762fd9c4

          SHA1

          9bb44da8d7f6457099cb56e4f7d1026963dce7ce

          SHA256

          593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

          SHA512

          ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
          Filesize

          186KB

          MD5

          58b58875a50a0d8b5e7be7d6ac685164

          SHA1

          1e0b89c1b2585c76e758e9141b846ed4477b0662

          SHA256

          2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

          SHA512

          d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id[6A3EC5BF-2939].[[email protected]].eking
          Filesize

          6.3MB

          MD5

          7bee265b8759596013932ad42e8bf282

          SHA1

          60141ccad181a5c510632c129ced1e92c4a75d60

          SHA256

          283a34f6457f42d79daea13f2e7c7aed1821151fb405129f0ae64912e40e87f0

          SHA512

          f825ffb27f97ec6fa9b44b0109b787e43fe8dff35e2f2b5fe500354dbeedb1a783c15fd38dfd956e87c5a75fe49ebe554353a1bcd990caaa61bcc27e6f77abd0

          Download Submit

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
          Filesize

          1.1MB

          MD5

          566ed4f62fdc96f175afedd811fa0370

          SHA1

          d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

          SHA256

          e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

          SHA512

          cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

          Download Submit

        • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
          Filesize

          859KB

          MD5

          02ee6a3424782531461fb2f10713d3c1

          SHA1

          b581a2c365d93ebb629e8363fd9f69afc673123f

          SHA256

          ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

          SHA512

          6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

          Download Submit

        • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
          Filesize

          547KB

          MD5

          cf6c595d3e5e9667667af096762fd9c4

          SHA1

          9bb44da8d7f6457099cb56e4f7d1026963dce7ce

          SHA256

          593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

          SHA512

          ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

          Download Submit

        • C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • C:\Users\Admin\AppData\Local\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
          Filesize

          252KB

          MD5

          9e2b9928c89a9d0da1d3e8f4bd96afa7

          SHA1

          ec66cda99f44b62470c6930e5afda061579cde35

          SHA256

          8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

          SHA512

          2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

          Download Submit

        • \PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • \PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • \Users\Admin\AppData\Local\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • \Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • \Users\Admin\AppData\Local\Temp\3582-490\a97a31e1a6c785b845feafd57b5d9474590005eb1ee0dba482335206c1d0b850.exe
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • \Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\A97A31~1.EXE
          Filesize

          55KB

          MD5

          f9a10997982874520035e0c206712daf

          SHA1

          c76d65009f28c92c2aadd1ebf84fbe94005ed6ac

          SHA256

          b3568d9cba48a76ba9d9a2cc881ca5c21b59ca12278fb6aba5a06d9b1f1969e0

          SHA512

          78f4c00074e494e46c3dcd285b06deaec4dd1287f6798df1f6e0e1c42d7f9fdc89d97a37f74790b973fccfe4183fd9c49e5862325e26ccfbf15b3a7f87efb337

          Download Submit

        • memory/1712-133-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-145-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-129-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-152-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-388-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-435-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-645-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download

        • memory/1712-955-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

          Download