neshta | 020218706196aeaae66cb4cc7cb12d0d73a78bca241e315868c4550351da6fb7

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_608cee9085771d7472baba768ea53c60.exe
Size

662KB
MD5

608cee9085771d7472baba768ea53c60
SHA1

f206fe5ae7790b47bd44bb2ac74106fe4aa1ec25
SHA256

020218706196aeaae66cb4cc7cb12d0d73a78bca241e315868c4550351da6fb7
SHA512

d0a53a2c1459a910554516a4ac832dade2c5eef6b654f09a78b9c2bf21da27fdeedb43e4858d9380d9af113c7a4c45b871c00b5f1ed7f379e483583e733a1345
SSDEEP

12288:BQZy90UBZYwaMEOlogiXMJTk1BY8tIR3MWIxwZ6sFtJH73SOlBPe9uUeD:BQZynBLaMBhiXMd+BNtIGWYwV73SO7PX

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c9c-17.dat	family_neshta
behavioral2/files/0x0004000000020378-31.dat	family_neshta
behavioral2/memory/3024-114-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3024-115-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3024-117-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	PROFES~1.EXE

Executes dropped EXE 3 IoCs

pid	Process
3780	333333~1.EXE
3024	PROFES~1.EXE
3496	PROFES~1.EXE

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	PROFES~1.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	PROFES~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	PROFES~1.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	PROFES~1.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	333333~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PROFES~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PROFES~1.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	PROFES~1.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3780	4132	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe	83
PID 4132 wrote to memory of 3780	4132	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe	83
PID 4132 wrote to memory of 3780	4132	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe	83
PID 4132 wrote to memory of 3024	4132	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe	86
PID 4132 wrote to memory of 3024	4132	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe	86
PID 4132 wrote to memory of 3024	4132	JaffaCakes118_608cee9085771d7472baba768ea53c60.exe	86
PID 3024 wrote to memory of 3496	3024	PROFES~1.EXE	87
PID 3024 wrote to memory of 3496	3024	PROFES~1.EXE	87
PID 3024 wrote to memory of 3496	3024	PROFES~1.EXE	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_608cee9085771d7472baba768ea53c60.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_608cee9085771d7472baba768ea53c60.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\333333~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\333333~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PROFES~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PROFES~1.EXE
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\3582-490\PROFES~1.EXE
    "C:\Users\Admin\AppData\Local\Temp\3582-490\PROFES~1.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
328KB

MD5
39c8a4c2c3984b64b701b85cb724533b

SHA1
c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

SHA256
888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

SHA512
f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\PROFES~1.EXE

Filesize
970KB

MD5
980fa616c9aff1752d36c9f13bbbc7c7

SHA1
7e0801ad6cde2609de39a8c0d9c632a40fac9ea4

SHA256
95c7b4a1cb9c13c1c028010d876686d4b4f9eea016bb00735824d5b469f68388

SHA512
a9b5745e9500abf5148b22ebaf241e60355d2ca7ac717f93c3a66a79bcaeeb5f6ac39a52aeb4cd91b470c2de8321a8a0586c0e6199e536c1f6491f2383ff37fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\333333~1.EXE

Filesize
509KB

MD5
343ca2fc75c83107a9515e4ca8207f41

SHA1
38fece6890fd96875630a98129486aae979daa7c

SHA256
2f553d635fa84fdbf36d71521285c5737060ec94c0dc6bb96bdd844af487bcda

SHA512
6aa353aaf61f038e6a3e513e7f8ddc04f6bc68ccca35d221cf413d181c964b40015bb6c9079b656a689c1c3f4b13e88511883cf906037c5b689ee5d18a884d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PROFES~1.EXE

Filesize
1010KB

MD5
f6f98fb7a4fc3b41ae3d21330bb25a31

SHA1
21a6600c25b940aff2d775ebd54469317aab976b

SHA256
0c7b451ee7949012eddd646bf0a729e463b98d0537ea5ed32f6a9645df9efdfc

SHA512
55d474677c74d399dc91c47ab7294698792da93d43d4b051b54d6d2f89e11bc0a7524d8947bfade915cc97850e917e0172b40398d429e60750303ded0fc2584c

Download Submit
memory/3024-117-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3024-115-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3024-114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3780-9-0x0000000004FA0000-0x0000000005544000-memory.dmp

Filesize
5.6MB

Download
memory/3780-15-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3780-12-0x0000000004A60000-0x0000000004A6A000-memory.dmp

Filesize
40KB

Download
memory/3780-13-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3780-11-0x0000000004B30000-0x0000000004BCC000-memory.dmp

Filesize
624KB

Download
memory/3780-10-0x0000000004A90000-0x0000000004B22000-memory.dmp

Filesize
584KB

Download
memory/3780-8-0x0000000000100000-0x0000000000186000-memory.dmp

Filesize
536KB

Download
memory/3780-7-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads