neshta | fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
Size

3.0MB
MD5

6d418f9bb6e0da291228fa29ad199eef
SHA1

2f941d68cd99574ed913b202edb064b4db29cc80
SHA256

fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8
SHA512

5cdc8682c9c545f96b8356e72ccd50d9282be4fa4048f297ccdde94c96af86af897e84ddda8ea7be1906e4dd6be7425ce72d6078229fe8d67a9cd128c8c08f7c
SSDEEP

98304:uncpXfAyL32dMh1y5LjkCNjBkN8KA7YvLld99R8:85ftNjPKA+lz8

Score

10^/10

neshta discovery evasion persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000700000002345d-7.dat	family_neshta
behavioral2/files/0x00070000000202ac-51.dat	family_neshta
behavioral2/memory/1204-134-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1204-135-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1204-137-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Executes dropped EXE 6 IoCs

pid	Process
1204	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
3992	icsys.icn.exe
4848	explorer.exe
4804	spoolsv.exe
2816	svchost.exe
3904	spoolsv.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~2.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MI9C33~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MIA062~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13195~1.15\MICROS~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~3.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.15\MICROS~4.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\svchost.com	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
3992	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4848	explorer.exe
2816	svchost.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
3992	icsys.icn.exe
3992	icsys.icn.exe
4848	explorer.exe
4848	explorer.exe
4804	spoolsv.exe
4804	spoolsv.exe
2816	svchost.exe
2816	svchost.exe
3904	spoolsv.exe
3904	spoolsv.exe
2944	OpenWith.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1204	2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe	82
PID 2560 wrote to memory of 1204	2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe	82
PID 2560 wrote to memory of 1204	2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe	82
PID 2560 wrote to memory of 3992	2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe	83
PID 2560 wrote to memory of 3992	2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe	83
PID 2560 wrote to memory of 3992	2560	fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe	83
PID 3992 wrote to memory of 4848	3992	icsys.icn.exe	84
PID 3992 wrote to memory of 4848	3992	icsys.icn.exe	84
PID 3992 wrote to memory of 4848	3992	icsys.icn.exe	84
PID 4848 wrote to memory of 4804	4848	explorer.exe	86
PID 4848 wrote to memory of 4804	4848	explorer.exe	86
PID 4848 wrote to memory of 4804	4848	explorer.exe	86
PID 4804 wrote to memory of 2816	4804	spoolsv.exe	87
PID 4804 wrote to memory of 2816	4804	spoolsv.exe	87
PID 4804 wrote to memory of 2816	4804	spoolsv.exe	87
PID 2816 wrote to memory of 3904	2816	svchost.exe	88
PID 2816 wrote to memory of 3904	2816	svchost.exe	88
PID 2816 wrote to memory of 3904	2816	svchost.exe	88

C:\Users\Admin\AppData\Local\Temp\fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
"C:\Users\Admin\AppData\Local\Temp\fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- \??\c:\users\admin\appdata\local\temp\fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
  c:\users\admin\appdata\local\temp\fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1204
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3992
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4804
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Filesize
9.4MB

MD5
322302633e36360a24252f6291cdfc91

SHA1
238ed62353776c646957efefc0174c545c2afa3d

SHA256
31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c

SHA512
5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

Download Submit
C:\Users\Admin\AppData\Local\Temp\fc976739158069732ea62a01e04b4a651f95a2805287501fdc54e5dab290f5b8.exe

Filesize
2.9MB

MD5
8dd8fc301995cb20e40c509965270d8a

SHA1
a27321158d7ac99a50ed6f9fb2697f0f92512f6f

SHA256
2f106cf736d68484e0de7f6dfc187a6077c65142443d0f76356c62f113715cb0

SHA512
4ce8c811a1f002a2f6b8b30eb2de65930d56cb9abab42eb89938bd836e7a598020fb66a49f08d8f7dc549725e12ff3f3b8dd81220e9ea1624a2ce6a4124a6cd8

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
6245debdbf7af9d776aa72fdcaeaf219

SHA1
ee529e6201481b66e97b9c9d6b96b8e9f4580b62

SHA256
61d6d144905f1bd04ef2f94b7e063289d1a50cbe15db3d47681d2e6fad364b8e

SHA512
e037152dc6dd97e4f02e0c6e26119bc439cc36b51b1db6caa63a81df868c51e4a15d8a614a18d4fc2d93ea401d829650f03d44d50ef2e2925b7c95edd2755986

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
28e5a597cf4579fe283e8c4ebfddaf17

SHA1
820cbb4e9c9a940d0002a6d6d1955a50d11f2770

SHA256
270a5880459803cc4f302a47e6513acc3bd225e7f06201454772a037c4ececaa

SHA512
bb8216c2b8d5b8e038eb4a80d7a5e05203d6e7b7b8fa0d499b765de4f4c7e289988f432f912890c6b02c4779e786c27cbef290655c14f43dfa13933ebd0fd7a4

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
cfcb67ff451acec6af144c07f63c0031

SHA1
c501f19f67bfa68528cbb3cabb6f1557b4060b2d

SHA256
528015061ebcb6fec2f138e6a5ac9760c8df2e0506b97a92610dbc4fb1329c09

SHA512
8ae3673a19fc5bc28e863e59229e21eb8faf88dfca82b0e5db4c646eea61cdb8ed097910170a3e82522be5cbfc092c04a012a2077d9388cfb784d7e15061565b

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
aaf72342a3bf447f83611af499731bc6

SHA1
6212a89e7d52d462465361782ed670178ca78fd9

SHA256
468583a2b580fc6a42ed112a0db535b402c4ec07db06a1c523dd9612c7a31309

SHA512
8daf0479ceee1a2d1a529249a54532c316fd846d76ec455aef4a2c045f4ff91df5f9afa4c2f824522ce78b80a2265334f32b7585843c6daad8b1d7ee36164404

Download Submit
memory/1204-135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1204-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1204-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2560-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2560-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2816-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3904-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3992-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4804-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4848-138-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download