Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/06/2024, 20:11
Behavioral task
behavioral1
Sample
PO 42050 EXP 1423.exe
Resource
win7-20240419-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO 42050 EXP 1423.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target PO 42050 EXP 1423.exe
- Size 737KB
- Sample240626-yyhtbs1ejf
- SHA256 6eb16df08e9ce41a8c5355c19817741c79386a93c402ffdbbffb5e221e609ab6
- MD5 ae06766ec1be8ae093bbd938c195986d
- SHA1 1f736cf91178489ab25b62e8b88d73b32324dd8d
- SHA512 674eca0b66ab7ae5eca88f4f8138747ad3df6417fb10f96150bdbbeae1928f713f3ee20b235380d072bc2230873dba0a856314e8bc65ab1401699e9bc721d72b
- SSDEEP 12288:EYV6MorX7qzuC3QHO9FQVHPF51jgcCf1qeO2+Zy7IAUQfRY2kMq/U6CAzADow5uC:DBXu9HGaVHZv2+Zy0QfqF//olP5uC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe - Executes dropped EXE 1 IoCs
pid Process 1804 name.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" svchost.exe -
resource yara_rule behavioral2/memory/3636-0-0x0000000000A80000-0x0000000000C1D000-memory.dmp upx behavioral2/files/0x000700000002340f-16.dat upx behavioral2/memory/3636-18-0x0000000000A80000-0x0000000000C1D000-memory.dmp upx behavioral2/memory/1804-19-0x0000000000490000-0x000000000062D000-memory.dmp upx behavioral2/memory/1804-41-0x0000000000490000-0x000000000062D000-memory.dmp upx - AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3636-18-0x0000000000A80000-0x0000000000C1D000-memory.dmp autoit_exe behavioral2/memory/1804-19-0x0000000000490000-0x000000000062D000-memory.dmp autoit_exe behavioral2/memory/1804-41-0x0000000000490000-0x000000000062D000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1804 set thread context of 460 1804 name.exe 81 - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE svchost.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe svchost.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe svchost.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE svchost.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe svchost.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe svchost.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" svchost.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1804 name.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3636 PO 42050 EXP 1423.exe 3636 PO 42050 EXP 1423.exe 1804 name.exe 1804 name.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3636 PO 42050 EXP 1423.exe 3636 PO 42050 EXP 1423.exe 1804 name.exe 1804 name.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3636 wrote to memory of 1804 3636 PO 42050 EXP 1423.exe 80 PID 3636 wrote to memory of 1804 3636 PO 42050 EXP 1423.exe 80 PID 3636 wrote to memory of 1804 3636 PO 42050 EXP 1423.exe 80 PID 1804 wrote to memory of 460 1804 name.exe 81 PID 1804 wrote to memory of 460 1804 name.exe 81 PID 1804 wrote to memory of 460 1804 name.exe 81 PID 1804 wrote to memory of 460 1804 name.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 42050 EXP 1423.exe"C:\Users\Admin\AppData\Local\Temp\PO 42050 EXP 1423.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\PO 42050 EXP 1423.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\PO 42050 EXP 1423.exe"3⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:460
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
- Size 2.4MB
- SHA256 ac5322711d79824bb5be0dce1b7bcc431efbb4c538fbcefe57d04867270e0cb7
- MD5 fda6ad2775db2a19f8cbed4f348143c3
- SHA1 2ba0dce08231f16a110665eaaac88f76e009f6e4
- SHA512 161ee40921ff3e347ab4b43d3858495ebdd8188e5b9f08bb76d52e8799c1a14c16ecb0fdb3019034e334e68a3d1337122a3a10c4d00382adc4ce92a3c7303be9
- SSDEEP 49152:izWYTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:eTfiG/nzU90T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe
- Size 40KB
- SHA256 f8898de9a8d6d10f61e1075471f4dbf21e52b5e71969d10675359fa7bfcbfd00
- MD5 02d5934d708008ecdbced2f8c1491727
- SHA1 21f7ab77b928386ace6ac3366ae017b0ac73ad3a
- SHA512 252b8652695b60222d1165eda50440893f1a5c5e59a6d2e607de80405fb1d083da3421a0b3d27f3dfb20e298253d0f04ae87d6c092270ac4f23056c33f6523a5
- SSDEEP 768:TX8tkOTFhAjOnKFURDsVRqmEvnMqvjZCu8HVTg4SR5KLY1PKH8:otkOTnAjOfARvan9Z0tgHEgP7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\aut43FE.tmp
- Size 305KB
- SHA256 c758c97ce7937b1e93c60ac9ae7fef2f417ab60523bafeeb46327ec9ff7bf4e0
- MD5 6c75f78f8f440d3116d35d0511ccc5e7
- SHA1 d17428682be6bcf1ffdb8d4e102b8ffe0275811f
- SHA512 6e1b53ed4f1a720fcec86b3f45ca4bb084d37b8caf8a28b5c80db25bb2e3db852d688c4549e8c6caa1fe9bff7445969f7612a74aad8f81afdd0f72867382a9e0
- SSDEEP 6144:O9+ddRfqKgD1UmkCCG/W93H3N8nZkLMMKoIi6szkU/594nmBv:O9GVqKgpkCXo3qJvi6sYgMmZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\indivisibility
- Size 28KB
- SHA256 7630ce80e245ecec1cc2cb85048c2ad15858eb288037a7278d08d742bbb2cba4
- MD5 82608510e687a53ea8883eaed0f35064
- SHA1 62d37ae8f8607fc92d8950e8733bc665ab791972
- SHA512 8e08ce5fd7c38d4d78913bbe2134630b99c5ffb6b99101c6e34df334fb2d6b0289ede9fa8d08b39eb949b73d870d5740b29e5857ee40bb72c508be77e412aa2e
- SSDEEP 768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+IAyd4vfF3if6gyuqM:miTZ+2QoioGRk6ZklputwjpjBkCiw2Rt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\directory\name.exe
- Size 737KB
- SHA256 6eb16df08e9ce41a8c5355c19817741c79386a93c402ffdbbffb5e221e609ab6
- MD5 ae06766ec1be8ae093bbd938c195986d
- SHA1 1f736cf91178489ab25b62e8b88d73b32324dd8d
- SHA512 674eca0b66ab7ae5eca88f4f8138747ad3df6417fb10f96150bdbbeae1928f713f3ee20b235380d072bc2230873dba0a856314e8bc65ab1401699e9bc721d72b
- SSDEEP 12288:EYV6MorX7qzuC3QHO9FQVHPF51jgcCf1qeO2+Zy7IAUQfRY2kMq/U6CAzADow5uC:DBXu9HGaVHZv2+Zy0QfqF//olP5uC
- MD5 SHA1 SHA512 SSDEEP