Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/10/2024, 03:33
General
-
Target
d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c.exe
-
Size
2.8MB
-
MD5
6f416a2a05246c3049ea9070e28e01d3
-
SHA1
506e664bf51923b3e784d235807d2aa88b812251
-
SHA256
d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c
-
SHA512
b575b89f4fe815ea0055e1f94502ee8f0127142755e4b8feeb56f0891c4e87d011b06da46d1dfdced3b17951efe5ee5dfc36e225634e3f8f75565fbfb86f48f6
-
SSDEEP
24576:xwPKcqaCbuHDZS2Xqbzsbx+80kL1y4/pCb9vEYhqKDhQBz8NA66W8MXPnAhnAGnb:yv7Cq1SfzIx+4JdWEim8ALWXXYWbbbW
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Modifies firewall policy service 3 TTPs 7 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Detects Floxif payload 1 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c.exe"C:\Users\Admin\AppData\Local\Temp\d7c9e99805f8135f67adba0344f04bd4eabad5b2ea57f7a9ddf204674c686c5c.exe"1⤵
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\MusaLLaT.exeC:\Users\Admin\AppData\Roaming\MusaLLaT.exe2⤵
- Modifies firewall policy service
- Modifies security service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
2.8MB
MD5df34658e40c632c826e461dd9fdd7de1
SHA13463ca70be5bda34397a3a784056f7cc55f04295
SHA256080b3e0aa96038e9d35dd80848910d130da21a48761e975db80508642e631a0f
SHA5122b2eef37b51b7d1677d540b5860ff6bbd70bcac0e345b5f9af2bf79e084c4cb194e57efa7f86dffb603d917ab6b9b4ff93b4be5a43dced38bdbe14f2fababbf4
-
Filesize
668KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB