Analysis

  • max time kernel
    137s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-07-2024 01:10

General

  • Target

    image001.exe

  • Size

    756KB

  • MD5

    31c87737ea27257492b80ffe38db4a02

  • SHA1

    202620c58aee7e3d873f344196fa43c5ad863baf

  • SHA256

    16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31

  • SHA512

    f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9

  • SSDEEP

    12288:PfyfpWOhx8kPn3HLK1ADGl8qWp5YXaZG5EpKXoz9E6IgybM6LIrGH0Tl2TAXjUva:PfyjiGuASGqM5YXH5U9bITbj8LTUTijU

Malware Config

Signatures

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\image001.exe
    "C:\Users\Admin\AppData\Local\Temp\image001.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\image001.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1204
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qwyxUYwZbCeXJ.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2536
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwyxUYwZbCeXJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF2EB.tmp"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:64
    • C:\Users\Admin\AppData\Local\Temp\image001.exe
      "C:\Users\Admin\AppData\Local\Temp\image001.exe"
      2⤵
        PID:1132
      • C:\Users\Admin\AppData\Local\Temp\image001.exe
        "C:\Users\Admin\AppData\Local\Temp\image001.exe"
        2⤵
        • Checks computer location settings
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        PID:4352

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      848d89ad9c658f8b2d26d53fdb2a132b

      SHA1

      438b8c0eca827d07cc11dc990f7c9344a2fe4943

      SHA256

      c32d7d1d2ccb84a9a9a6db165b9ac0447d9cfbd2d55e8a25f6fa52462e44683b

      SHA512

      f96d7f45a4805bb4adc3636da7ed71647641d73dc9eaaa359a35ef23f535a87b0d511666a012c6ff59ff40457ceb408a931e80bcedcb84ab3991fcc9720ffd2f

    • C:\Users\Admin\AppData\Local\Temp\3582-490\image001.exe

      Filesize

      716KB

      MD5

      eab1cbc9e7da6d32d557dfc901918f72

      SHA1

      c8c710ccda27bbf5f82b36aa387c1c8a9f14b5d2

      SHA256

      9343e70417d6d5d6db49c9fa263337c953183ec07f3ee524a43e6d3976cf5dd3

      SHA512

      aca29afd5a5fb66aa9d4facd5d4bd6fe5b20ae2ac6987fc998ae28407cb6f2983071a1ba0d831baaa72c5a0df0a319065bd08f6c71e3baa993f183f5edd9ceb2

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bumaexfm.ulv.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpF2EB.tmp

      Filesize

      1KB

      MD5

      3b0ca8262bd10ceb95a5c6e3607e6df5

      SHA1

      07987d58f031301353a3a0d40709aa42f32dabf9

      SHA256

      8913eedeae091e8951416759ca6ac52f3496be0afa95012a42e0fc69e3cbc4d0

      SHA512

      a81944d1db5e7a7549b13cb945eb1c6952f16d5a4919c214adc2098e73f7bc75571a9c01c753bd3b41dd5c51996425115ba9a7f90f3b01b11fd1ffd27f2ca8ba

    • C:\Users\Admin\AppData\Roaming\QWYXUY~1.EXE

      Filesize

      756KB

      MD5

      31c87737ea27257492b80ffe38db4a02

      SHA1

      202620c58aee7e3d873f344196fa43c5ad863baf

      SHA256

      16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31

      SHA512

      f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9

    • C:\Windows\svchost.com

      Filesize

      40KB

      MD5

      a84134e51db793d68b3b1a8718eb3b32

      SHA1

      0ff8ae348f19210799b74168610771d019e6ac26

      SHA256

      88a5de78b70d1164451d38d1415bbba1e374ffca345c089701e6a750212960f6

      SHA512

      49bb49e190f435708fb2cc8461eace217d883a202a157f812b4277afb582a47db9944abaf7313d909958bfa0b40ee57fbacb844327eeab46ba0b5b4d37b15ec8

    • memory/1204-44-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/1204-140-0x0000000007D50000-0x0000000007D64000-memory.dmp

      Filesize

      80KB

    • memory/1204-169-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/1204-14-0x0000000002EC0000-0x0000000002EF6000-memory.dmp

      Filesize

      216KB

    • memory/1204-15-0x0000000005A60000-0x0000000006088000-memory.dmp

      Filesize

      6.2MB

    • memory/1204-16-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/1204-18-0x0000000005720000-0x0000000005742000-memory.dmp

      Filesize

      136KB

    • memory/1204-151-0x0000000007E30000-0x0000000007E38000-memory.dmp

      Filesize

      32KB

    • memory/1204-150-0x0000000007E50000-0x0000000007E6A000-memory.dmp

      Filesize

      104KB

    • memory/1204-20-0x0000000005830000-0x0000000005896000-memory.dmp

      Filesize

      408KB

    • memory/1204-17-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/1204-60-0x00000000067F0000-0x000000000680E000-memory.dmp

      Filesize

      120KB

    • memory/1204-133-0x0000000007D40000-0x0000000007D4E000-memory.dmp

      Filesize

      56KB

    • memory/1204-104-0x0000000007D10000-0x0000000007D21000-memory.dmp

      Filesize

      68KB

    • memory/1204-103-0x0000000007D90000-0x0000000007E26000-memory.dmp

      Filesize

      600KB

    • memory/1204-99-0x0000000007B80000-0x0000000007B8A000-memory.dmp

      Filesize

      40KB

    • memory/1204-77-0x0000000007B10000-0x0000000007B2A000-memory.dmp

      Filesize

      104KB

    • memory/1204-76-0x0000000008160000-0x00000000087DA000-memory.dmp

      Filesize

      6.5MB

    • memory/1204-75-0x00000000079E0000-0x0000000007A83000-memory.dmp

      Filesize

      652KB

    • memory/1204-74-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

      Filesize

      120KB

    • memory/1204-63-0x00000000079A0000-0x00000000079D2000-memory.dmp

      Filesize

      200KB

    • memory/1204-42-0x0000000006190000-0x00000000064E4000-memory.dmp

      Filesize

      3.3MB

    • memory/1204-64-0x0000000070D20000-0x0000000070D6C000-memory.dmp

      Filesize

      304KB

    • memory/1204-62-0x00000000068C0000-0x000000000690C000-memory.dmp

      Filesize

      304KB

    • memory/2536-22-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/2536-48-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/2536-176-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/2536-40-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/2536-19-0x0000000005350000-0x00000000053B6000-memory.dmp

      Filesize

      408KB

    • memory/2536-79-0x0000000070D20000-0x0000000070D6C000-memory.dmp

      Filesize

      304KB

    • memory/4352-45-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/4352-46-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/4816-41-0x00000000747CE000-0x00000000747CF000-memory.dmp

      Filesize

      4KB

    • memory/4816-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

      Filesize

      4KB

    • memory/4816-61-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4816-6-0x0000000005E00000-0x0000000005E9C000-memory.dmp

      Filesize

      624KB

    • memory/4816-8-0x0000000006D90000-0x0000000006D9E000-memory.dmp

      Filesize

      56KB

    • memory/4816-7-0x0000000008850000-0x0000000008860000-memory.dmp

      Filesize

      64KB

    • memory/4816-5-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4816-9-0x0000000006DD0000-0x0000000006E5E000-memory.dmp

      Filesize

      568KB

    • memory/4816-3-0x0000000005B30000-0x0000000005BC2000-memory.dmp

      Filesize

      584KB

    • memory/4816-2-0x00000000060E0000-0x0000000006684000-memory.dmp

      Filesize

      5.6MB

    • memory/4816-1-0x0000000000FD0000-0x0000000001094000-memory.dmp

      Filesize

      784KB

    • memory/4816-4-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

      Filesize

      40KB