Analysis
- max time kernel
138s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 07:16
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
order SL2024-01.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
order SL2024-01.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target order SL2024-01.exe
- Size 1.2MB
- Sample240619-h3ysca1amn
- SHA256 12afbeae36c86ffa1781c6faac9cd3b460fe5835c55b901e7ec28e39df418d5e
- MD5 827d17ea8908eee608affcbf9a41a4a8
- SHA1 082df822af7674e9851f707a11eb948d9dd3107b
- SHA512 71d6039b72fb1c31f47233d8706fc846da76016f8f99bf550b9933add346e4f6847ae2f9d26dd0ebbde5beb2ad1d4690e1b29a2761fd2232345f9657cb89722e
- SSDEEP 24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaoXBKqF3Qb11YDO1Qo95:Dh+ZkldoPK8YaokqFWoDn6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file5.vbs file5.exe - Executes dropped EXE 2 IoCs
pid Process 1176 file5.exe 2676 file5.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" svchost.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000b0000000233fa-15.dat autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2676 set thread context of 1736 2676 file5.exe 88 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI391D~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\COOKIE~1.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE svchost.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\BHO\IE_TO_~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\PWAHEL~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MIA062~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\IDENTI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE svchost.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\INSTAL~1\setup.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\MSEDGE~2.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\MSEDGE~3.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\msedge.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\MSEDGE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\NOTIFI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe svchost.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" svchost.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1176 file5.exe 2676 file5.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1240 order SL2024-01.exe 1240 order SL2024-01.exe 1176 file5.exe 1176 file5.exe 2676 file5.exe 2676 file5.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1240 order SL2024-01.exe 1240 order SL2024-01.exe 1176 file5.exe 1176 file5.exe 2676 file5.exe 2676 file5.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1240 wrote to memory of 1176 1240 order SL2024-01.exe 85 PID 1240 wrote to memory of 1176 1240 order SL2024-01.exe 85 PID 1240 wrote to memory of 1176 1240 order SL2024-01.exe 85 PID 1176 wrote to memory of 664 1176 file5.exe 86 PID 1176 wrote to memory of 664 1176 file5.exe 86 PID 1176 wrote to memory of 664 1176 file5.exe 86 PID 1176 wrote to memory of 2676 1176 file5.exe 87 PID 1176 wrote to memory of 2676 1176 file5.exe 87 PID 1176 wrote to memory of 2676 1176 file5.exe 87 PID 2676 wrote to memory of 1736 2676 file5.exe 88 PID 2676 wrote to memory of 1736 2676 file5.exe 88 PID 2676 wrote to memory of 1736 2676 file5.exe 88 PID 2676 wrote to memory of 1736 2676 file5.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\order SL2024-01.exe"C:\Users\Admin\AppData\Local\Temp\order SL2024-01.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\directory\file5.exe"C:\Users\Admin\AppData\Local\Temp\order SL2024-01.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\order SL2024-01.exe"3⤵PID:664
-
-
C:\Users\Admin\AppData\Local\directory\file5.exe"C:\Users\Admin\AppData\Local\directory\file5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\directory\file5.exe"4⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1736
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
- Size 2.4MB
- SHA256 ac5322711d79824bb5be0dce1b7bcc431efbb4c538fbcefe57d04867270e0cb7
- MD5 fda6ad2775db2a19f8cbed4f348143c3
- SHA1 2ba0dce08231f16a110665eaaac88f76e009f6e4
- SHA512 161ee40921ff3e347ab4b43d3858495ebdd8188e5b9f08bb76d52e8799c1a14c16ecb0fdb3019034e334e68a3d1337122a3a10c4d00382adc4ce92a3c7303be9
- SSDEEP 49152:izWYTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:eTfiG/nzU90T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe
- Size 40KB
- SHA256 f8898de9a8d6d10f61e1075471f4dbf21e52b5e71969d10675359fa7bfcbfd00
- MD5 02d5934d708008ecdbced2f8c1491727
- SHA1 21f7ab77b928386ace6ac3366ae017b0ac73ad3a
- SHA512 252b8652695b60222d1165eda50440893f1a5c5e59a6d2e607de80405fb1d083da3421a0b3d27f3dfb20e298253d0f04ae87d6c092270ac4f23056c33f6523a5
- SSDEEP 768:TX8tkOTFhAjOnKFURDsVRqmEvnMqvjZCu8HVTg4SR5KLY1PKH8:otkOTnAjOfARvan9Z0tgHEgP7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\aut3D67.tmp
- Size 305KB
- SHA256 c33f87666040884ab0f834f40bc9b9439f67c21c0397c10989081a1cbaf3ef45
- MD5 5a82d2ba2918d9b69b8d2e33453508db
- SHA1 10630a647881d8afbcab3792b75fc8b9ad5951dc
- SHA512 86113245589e0d877fafa9436501d931c7a1ec5d2afc0ea415e74b85b00209157ced185a8d41076d0537ca160a8cbbbbcbbfed3bf4f3495fe696a1b59b169258
- SSDEEP 6144:lLDYquXBPdDb6c/UcSf1bCWkSU7Uwjfu3Vq806/XbpEpQ+yAa1Q27y8+ga4Xd:x5UJcYSf1b7khjV6/yQ+yAnkYQt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\aut4298.tmp
- Size 9KB
- SHA256 98d60eabac5d06c99b4bd26abf0e5f6923732879e2da20648dbc6b50d63b047c
- MD5 8bd1753cdaeedb7ae8d8f542b6228734
- SHA1 66aa541fa71b9257c798312a721235d45fd856ad
- SHA512 ed8e99fbe66b98e0e4dca83149239092054e13dc7b47e2ffac429a723052b81509f3901d56b7a36529e8308cdba9d0f943a3fa9cf089de1537d249549fd1c8db
- SSDEEP 192:zS5jnkklyInfvU1WgUdphl8IGW+CIYtYnHAuWLnDg77ACeOyvGfu:cnSIHUYVFljGW+CIaYHWLe0TOyvWu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\done
- Size 28KB
- SHA256 154599a882d84df848b842b1262f810a1ee21f273357de1f1ac812821ba3d8ae
- MD5 764c56ef5805ba4e1b8a20f7c7515762
- SHA1 43d20748615fdcbc5dc2781c7ec39aa05d93dd66
- SHA512 9f2be8f1e9f067b88450436abc57a7305507c0429c7ffa3ee3134b466b7d43f41b435f30cb4664d4c16dfcf1172692e9965d121907930aea8307982543596cfa
- SSDEEP 768:+fiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbCO+IFvIQ84vfF3if65:yiTZ+2QoioGRk6ZklputwjpjBkCiw2Rd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\directory\file5.exe
- Size 1.2MB
- SHA256 12afbeae36c86ffa1781c6faac9cd3b460fe5835c55b901e7ec28e39df418d5e
- MD5 827d17ea8908eee608affcbf9a41a4a8
- SHA1 082df822af7674e9851f707a11eb948d9dd3107b
- SHA512 71d6039b72fb1c31f47233d8706fc846da76016f8f99bf550b9933add346e4f6847ae2f9d26dd0ebbde5beb2ad1d4690e1b29a2761fd2232345f9657cb89722e
- SSDEEP 24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaoXBKqF3Qb11YDO1Qo95:Dh+ZkldoPK8YaokqFWoDn6
- MD5 SHA1 SHA512 SSDEEP