neshta | d73eb41e4f5c041fa715b811036b1f0b43321848eb52933cf62aba5a84b183ce

Analysis

max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2024, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe
Size

1.6MB
MD5

782a27adf82c279dd5f5ad2df218d8d4
SHA1

821cd1b08324ff4e48032644799baf28237693e8
SHA256

d73eb41e4f5c041fa715b811036b1f0b43321848eb52933cf62aba5a84b183ce
SHA512

8e4a381f780664ecb2e083a565177577512dd77c15d57e35bbed2e74153c4ae5c6df7ac72568784f455ceaa1ec6d932ab6c58c41be03b5c78066ec31516942bd
SSDEEP

24576:ijRdwFjVUK0ElMZPh6/08PWf4XlAiYqiMGGFnNEj5qBTMq8yN7Zb:GaFpJlmh6ZPWf4XyiTxN6qBEadb

Score

10^/10

neshta discovery persistence spyware stealer upx

Malware Config

Signatures

Detect Neshta payload 39 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b0c-4.dat	family_neshta
behavioral2/files/0x000a000000023b6a-22.dat	family_neshta
behavioral2/files/0x000a000000023b6c-34.dat	family_neshta
behavioral2/files/0x0004000000020351-50.dat	family_neshta
behavioral2/files/0x0004000000020352-55.dat	family_neshta
behavioral2/files/0x0006000000020249-62.dat	family_neshta
behavioral2/files/0x0004000000020325-61.dat	family_neshta
behavioral2/memory/1992-63-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x0008000000020253-65.dat	family_neshta
behavioral2/files/0x00010000000214f6-79.dat	family_neshta
behavioral2/files/0x00010000000214f5-81.dat	family_neshta
behavioral2/files/0x00010000000214f4-80.dat	family_neshta
behavioral2/files/0x0001000000022f47-84.dat	family_neshta
behavioral2/files/0x0001000000022f86-92.dat	family_neshta
behavioral2/files/0x00010000000167ff-95.dat	family_neshta
behavioral2/files/0x0001000000016802-103.dat	family_neshta
behavioral2/files/0x000100000001dbb6-109.dat	family_neshta
behavioral2/files/0x0001000000016914-121.dat	family_neshta
behavioral2/files/0x000300000001e8be-133.dat	family_neshta
behavioral2/files/0x000b00000001e60a-138.dat	family_neshta
behavioral2/files/0x000b00000001ee17-142.dat	family_neshta
behavioral2/files/0x00010000000228fb-147.dat	family_neshta
behavioral2/files/0x000200000002277d-151.dat	family_neshta
behavioral2/files/0x0002000000000729-153.dat	family_neshta
behavioral2/files/0x000300000001e86b-157.dat	family_neshta
behavioral2/files/0x000400000001e6a1-162.dat	family_neshta
behavioral2/files/0x000400000001e286-160.dat	family_neshta
behavioral2/files/0x000a00000001e7fa-169.dat	family_neshta
behavioral2/files/0x000500000001e8b7-168.dat	family_neshta
behavioral2/files/0x000e00000001f3d7-163.dat	family_neshta
behavioral2/files/0x00020000000215eb-155.dat	family_neshta
behavioral2/memory/2716-170-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4832-171-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4832-174-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2716-173-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4832-177-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2716-176-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2716-181-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4832-180-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 4 IoCs

pid	Process
2716	server.exe
4832	Client.exe
1992	svchost.com
2156	Client.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	server.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b69-21.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	server.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	server.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	server.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	Client.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	server.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	server.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	server.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	server.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	server.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	server.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	server.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	server.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	server.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	Client.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	server.exe
File opened for modification	C:\Windows\svchost.com	Client.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	server.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	Client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2716	3976	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe	85
PID 3976 wrote to memory of 2716	3976	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe	85
PID 3976 wrote to memory of 2716	3976	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe	85
PID 3976 wrote to memory of 4832	3976	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe	86
PID 3976 wrote to memory of 4832	3976	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe	86
PID 3976 wrote to memory of 4832	3976	782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe	86
PID 4832 wrote to memory of 1992	4832	Client.exe	87
PID 4832 wrote to memory of 1992	4832	Client.exe	87
PID 4832 wrote to memory of 1992	4832	Client.exe	87
PID 1992 wrote to memory of 2156	1992	svchost.com	88
PID 1992 wrote to memory of 2156	1992	svchost.com	88
PID 1992 wrote to memory of 2156	1992	svchost.com	88

C:\Users\Admin\AppData\Local\Temp\782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\782a27adf82c279dd5f5ad2df218d8d4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
      C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

Filesize
5.7MB

MD5
471811cb30f5b707e1cb8d898ab9dd85

SHA1
d27a6db0457555ad5187eab3438073eb1034418e

SHA256
f4609ed3168deec3c6150a064956ce61bea6e18c746e55ca0b032ba56fc1f75c

SHA512
118f658797e84b08dd5495406ebb1c0dec96833ddbfe189777640085ddc47c3a943c2effed4273f4fec679269d1849ff9cd54bb31a1abb632438225cfca9af29

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

Filesize
131KB

MD5
5791075058b526842f4601c46abd59f5

SHA1
b2748f7542e2eebcd0353c3720d92bbffad8678f

SHA256
5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

SHA512
83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

Filesize
92KB

MD5
176436d406fd1aabebae353963b3ebcf

SHA1
9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a

SHA256
2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f

SHA512
a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

Filesize
278KB

MD5
12c29dd57aa69f45ddd2e47620e0a8d9

SHA1
ba297aa3fe237ca916257bc46370b360a2db2223

SHA256
22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880

SHA512
255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

Filesize
1.2MB

MD5
8e42f3a4a399d84e67ed633ba23863cb

SHA1
02ebfa5274214dcc48acfd24b8da3fb5cb93f6c6

SHA256
42716ea8beca9e555cef3b78a2fbf836c9da034318d625262810290309d955db

SHA512
0f6af721a89c2cf7249ecb1cc0a263c6252f8762b7381b35ccff6347d7d069799d2f0561bec0a651d690fbf29c98050bf15b604d3cca668b7437503ba102492f

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe

Filesize
366KB

MD5
5e635549ecc44d3e5923ff6452eb9bd4

SHA1
7884700d0a660b54e1d5e3fa4af3207cbaaa125b

SHA256
aa030c665b05e8d3d017ee6905a38388404d56df96d824071a3faf40f82a6e15

SHA512
0f7552eec8ece78ed1eaf91e2388fe5ddbc20310bced15cb69b2f9239b9f928489fa442a03b3d7e55d3736b46a6f9e87e0a9396993e1819c6c60e86bb2f561bc

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe

Filesize
366KB

MD5
2a3ce2355b0c308965d8047df08eba0c

SHA1
6e610be18c0bed753a362171f4673f3c1dbc9d31

SHA256
e37d3f7187a7c1cc6a9129eed61b31d109300719d2a1fdc51ffef1aeeccc7102

SHA512
63023511b424d05e3a10b02cccf172a3561b373d5989a3701c82f0afa513c3c17d15fa77c2ea89a68debb872a5b77b37d1cd5fe3f0684d9ac2d9bdcdcb68fd4d

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe

Filesize
505KB

MD5
452c3ce70edba3c6e358fad9fb47eb4c

SHA1
d24ea3b642f385a666159ef4c39714bec2b08636

SHA256
da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c

SHA512
fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE

Filesize
146KB

MD5
d9a290f7aec8aff3591c189b3cf8610a

SHA1
7558d29fb32018897c25e0ac1c86084116f1956c

SHA256
41bed95cb1101181a97460e2395efebb0594849e6f48b80a2b7c376ddf5ce0ea

SHA512
b55ab687a75c11ba99c64be42ad8471576aa2df10ce1bb61e902e98827e3a38cd922e365751bd485cac089c2bd8bccf939a578da7238506b77fe02a3eb7994c6

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE

Filesize
433KB

MD5
674eddc440664b8b854bc397e67ee338

SHA1
af9d74243ee3ea5f88638172f592ed89bbbd7e0d

SHA256
20bbf92426732ff7269b4f2f89d404d5fee0fa6a20944004d2eeb3cc2d1fa457

SHA512
5aced0e2235f113e323d6b28be74da5e4da4dc881629461df4644a52bccd717dc6d2632c40ed8190b3ad060b8b62c347757a0bbe82680d892114c1f0529146b7

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe

Filesize
250KB

MD5
5d656c152b22ddd4f875306ca928243a

SHA1
177ff847aa898afa1b786077ae87b5ae0c7687c7

SHA256
4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69

SHA512
d5e50ee909ea06e69fc0d9999c6d142f9154e6f63462312b4e950cf6e26a7d395dbb50c8e2a8c4f4e1cfb7b2c6ae8ad19e3b7c204c20e7557daa1a0deb454160

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE

Filesize
509KB

MD5
7c73e01bd682dc67ef2fbb679be99866

SHA1
ad3834bd9f95f8bf64eb5be0a610427940407117

SHA256
da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d

SHA512
b2f3398e486cde482cb6bea18f4e5312fa2db7382ca25cea17bcba5ab1ff0e891d59328bc567641a9da05caca4d7c61dc102289d46e7135f947ce6155e295711

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE

Filesize
2.8MB

MD5
eb008f1890fed6dc7d13a25ff9c35724

SHA1
751d3b944f160b1f77c1c8852af25b65ae9d649c

SHA256
a9b7b9155af49d651b092bb1665447059f7a1d0061f88fa320d4f956b9723090

SHA512
9cfe3480f24bf8970ad5773cb9df51d132ee90ada35cbf8ec1222e09a60ae46b2ff4b96862fea19085b1c32f93c47c69f604589fa3f4af17e5d67bef893b6bf1

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe

Filesize
3.2MB

MD5
5119e350591269f44f732b470024bb7c

SHA1
4ccd48e4c6ba6e162d1520760ee3063e93e2c014

SHA256
2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873

SHA512
599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

Download Submit
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
715KB

MD5
f34835c1f458f93cd9041bfa7d01ee7d

SHA1
283ac4059492a22e10f7fcef219e52e0400a8926

SHA256
afc5cc567db1a3318c89dd0efad2ca60a353290bc25d98bbbba8e6f1492e23b1

SHA512
d5cc2244f1b6492dd9e66c6e917c2dfaa11376d4a8d1dea2c241cd35ce947ad919e47d1a78dea0c1f6cd6fa1e74426f806ddcf9ed3e8f25a9ae7c370b09e6857

Download Submit
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
525KB

MD5
0d9146d70ac6a41ead1ea2d50d729508

SHA1
b9e6ff83a26aaf105640f5d5cdab213c989dc370

SHA256
0b876ddeefd88d5e98de7e409c5b6546ba8ffa195c168f9a4b6ba33b44d437ab

SHA512
c9394decfd469bfedd883095d604e11208aa290334ff5c0dce852f2ca74fba27c37ba2984dab8b27430e573681e22c9f903e53b01510a4b77d337cbd92c56cb3

Download Submit
C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE

Filesize
650KB

MD5
72d0addae57f28c993b319bfafa190ac

SHA1
8082ad7a004a399f0edbf447425f6a0f6c772ff3

SHA256
671be498af4e13872784eeae4bae2e462dfac62d51d7057b2b3bebff511b7d18

SHA512
98bcde1133edbff713aa43b944dceb5dae20a9cbdf8009f5b758da20ccfbcdf6d617f609a7094aa52a514373f6695b0fd43c3d601538483816cd08832edd15ab

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe

Filesize
534KB

MD5
7938efde15e01ef5eaba10b21de7c00b

SHA1
8ccb8f1cc388c69aa7af933691f92594c086b53b

SHA256
a861e61a3ef4aaedf860ff88ffd94cbe0758c4205364008f48aa2f9a01c6738e

SHA512
6ba1901b7fa79a1d8e9d6f52a5e3e66a7787724bf2af1bf22a61386d196cf0583ba413cffc728e45cf400d2996feba20525090ce72f39bc5a8d043f8900d1f40

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

Filesize
6.7MB

MD5
32853955255a94fcd7587ca9cbfe2b60

SHA1
c33a88184c09e89598f0cabf68ce91c8d5791521

SHA256
64df64b39ac4391aea14eb48b0489e6a970a3ea44c02c6a8f10c278cc0636330

SHA512
8566b69668729d70567ff494de8f241329baf2a7748ab0ebf5a53308c3e53e646100af4f6fc33325f3851030d11ff045a7e85e5897008e95c991990d8f80a997

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
526KB

MD5
cc5020b193486a88f373bedca78e24c8

SHA1
61744a1675ce10ddd196129b49331d517d7da884

SHA256
e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a

SHA512
bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
674KB

MD5
97510a7d9bf0811a6ea89fad85a9f3f3

SHA1
2ac0c49b66a92789be65580a38ae9798237711db

SHA256
c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

SHA512
2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
495KB

MD5
9597098cfbc45fae685d9480d135ed13

SHA1
84401f03a7942a7e4fcd26e4414b227edd9b0f09

SHA256
45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

SHA512
16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{63880~1\WINDOW~1.EXE

Filesize
650KB

MD5
558fdb0b9f097118b0c928bb6062370a

SHA1
ad971a9a4cac3112a494a167e1b7736dcd6718b3

SHA256
90cee4a89cc1401ac464818226b7df69aa930804cefce56758d4e2ea0009d924

SHA512
5d08d5428e82fb3dad55c19e2c029de8f16e121faac87575b97f468b0ec312b3e0696225546cba91addaaf8f2451d44ae6386b4e4f7f621ce45055f3be797d7c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{D87AE~1\WINDOW~1.EXE

Filesize
650KB

MD5
2f826daacb184077b67aad3fe30e3413

SHA1
981d415fe70414aaac3a11024e65ae2e949aced8

SHA256
a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222

SHA512
2a6d9bdf4b7be9b766008e522cbb2c21921ba55d84dfde653ca977f70639e342a9d5548768de29ae2a85031c11dac2ae4b3c76b9136c020a6e7c9a9a5879caeb

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
495KB

MD5
07e194ce831b1846111eb6c8b176c86e

SHA1
b9c83ec3b0949cb661878fb1a8b43a073e15baf1

SHA256
d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

SHA512
55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE

Filesize
2.4MB

MD5
1319acbba64ecbcd5e3f16fc3acd693c

SHA1
f5d64f97194846bd0564d20ee290d35dd3df40b0

SHA256
8c6f9493c2045bb7c08630cf3709a63e221001f04289b311efb259de3eb76bce

SHA512
abbbb0abfff1698e2d3c4d27d84421b90abba1238b45884b82ace20d11ddfdd92bf206519fc01714235fb840258bb1c647c544b9a19d36f155bf3224916805b8

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe

Filesize
1.7MB

MD5
e25ffbddf046809226ea738583fd29f9

SHA1
ebda60d1f49cd1c2559d6c0f0a760dac7f38ce98

SHA256
91630469f3d18ebf1be43522b6dcb6547c3b67ab7a17a246e1b2122628dfcd80

SHA512
4417cba81c77c2a60e448b69dc615574ed4862fd97af014ebdf3ffbdde8a6c9bc32aca4881f59037f908a67b674d9e49b817fc1e6865e8f08e374f36baade101

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe

Filesize
2.2MB

MD5
3233023d79714cc0e649c1beb75a23b2

SHA1
3052a8d2a143b846cd02b153bf6961052558c254

SHA256
88e962e7fd534312bfa62a86a54f486d52091166ec06bee09125fe771816c8cc

SHA512
70f0fcae8702b9cd232e7968da15849280c9377c44233a0c82f13aee439fd3998d8ac81be81c59d20aacd47ebde47248414234c5158f1cf2e15d95b7cdcf8826

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\server.exe

Filesize
154KB

MD5
f799f56ec4724f497d2f0c777fe4829e

SHA1
2076f7101b1dd146d11674517f822da52c70fef7

SHA256
316762b502209f61769a6d903c897e9b592419c2a0cbc04779e6939b2dc47386

SHA512
1a2eaa600e55019f55abe835513aad7011360d91140894383836cea569d3ce7aa2bf242da9ed32feda43e483b034a513156d2d144fcd1d9ec0af00dd6c4e3c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
2.3MB

MD5
42e31cc6bbb33fb0eeb39fa1079a1887

SHA1
a64686dbb4aa55f29966d1da82df1b914c0015b6

SHA256
d3bfdd4a88b2252288750871ac7c5704decc5ba7ac9b8c5ae5b565f5e11f93e4

SHA512
f35cfce98adf36319e280c46fba4d8e23174d8ac46b9560d2ffaf1c92bca887f3cd429a6d30faf78ed8eeeeb2999803c1bd3f1b34d38f8e39ef47c5242718153

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
195KB

MD5
9529e45f1d934314a2b25fbad6b6d8e8

SHA1
30453c0833fabe89438a07ee89a53eddacc19200

SHA256
3238cfbd6a3e521c6a6452df83ed28f860d8309ee49e82695aa46b68f330b2da

SHA512
f7bf2bb62e40e1d06d3e670bcdaef986ba6ef132f66e87281d5829be7fc8051e3555a8cbab7f78ab0fa12bb931478f248e482f75b0a428e60d6f5c52be2e4185

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
36fd5e09c417c767a952b4609d73a54b

SHA1
299399c5a2403080a5bf67fb46faec210025b36d

SHA256
980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

SHA512
1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

Download Submit
memory/1992-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2156-172-0x0000000000400000-0x0000000000649000-memory.dmp

Filesize
2.3MB

Download
memory/2716-170-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2716-173-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2716-176-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2716-181-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4832-171-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4832-174-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4832-177-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4832-180-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads