Analysis
- max time kernel
101s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250410-en - resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system - submitted
25/04/2025, 04:07
Behavioral task
behavioral1
Sample
0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe
Resource
win11-20250410-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe
- Size 760KB
- Sample250425-ept1fssqw2
- SHA256 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d
- MD5 97150d47ea7779101be6582fc329c2cd
- SHA1 90d26907e69825f324441ad89cb677adbbd8bed9
- SHA512 7d742b0de6a4019b105e240c24f5d4662e50debe449ecb683637fc2b1f3a6908b7c81551e23d5bea459ae7e5d0abd47225ce442279a45fd9dfe45faeac6f9ed3
- SSDEEP 12288:WQYktDNYlg2317DJtY7wdD30qoifK/Ke5ABa4QP9+NrMke03fX55WxiXAVDDQlFH:4lHY7wdD30qnfsKxB+ZKX55WsSuFrvN1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
C:\Program Files\7-Zip\readme.txt
Ransom Note
- --= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 6994669932656897989 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion
URLs
-
http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion
-
http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion
-
http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion
-
http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion
-
http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion
-
http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion
-
http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion
Signatures
- Detect Neshta payload 5 IoCs
resource yara_rule behavioral2/files/0x0006000000027b0d-446.dat family_neshta behavioral2/memory/2748-1569-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2748-6916-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2748-10058-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2748-10060-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- VanHelsing
VanHelsing ransomware was first observed in March 2025.
- Vanhelsing family
- Renames multiple (3242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 1484 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-125.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Dismiss.scale-80.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-96.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-125.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\inifile.targetsize-24.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\README.txt 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\README.txt 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\telemetryrules\hxoutlook.exe_Rules.xml 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-32_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.Terminal.Settings.Editor\Interaction.xaml 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-24_altform-unplated_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Grid.js 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_col.hxc 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Microsoft.IoT.Cortana.winmd 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-20.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-16.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_Cancel_SM.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\README.txt 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\Assets\OneDrive_consumer_systray_block_dark.svg 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-256_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingNews_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsWideTile.scale-125_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SnipSketchWideTile.scale-125.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SnipSketchStoreLogo.scale-100.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.scale-125_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-lightunplated_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-36_altform-lightunplated_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsHeader.js 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-32.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72_altform-lightunplated_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-200.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-48_altform-lightunplated.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-100.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-40_altform-unplated.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\node_modules\@microsoft\load-themed-styles\lib-amd\index.js 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\MediumTile.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\SelectableOption.js 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-125_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\Xbox_AppList.scale-200_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-32_altform-unplated.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_StoreLogo.scale-100_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-20.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\dist\fluentui-react.umd.js 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-us\outlook_whatsnew.xml 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailFirstRunLogo.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\StoreLogo.scale-400_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_contrast-black.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.scale-125.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.21012.10511.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-125_contrast-white.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\resources.pri 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadWideTile.scale-100.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreSplashScreen.scale-200.png 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 4516 1484 WerFault.exe 80 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2748 wrote to memory of 1484 2748 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe 80 PID 2748 wrote to memory of 1484 2748 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe 80 PID 2748 wrote to memory of 1484 2748 0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe"C:\Users\Admin\AppData\Local\Temp\0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe"1⤵
- Modifies system executable filetype association
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 27883⤵
- Program crash
PID:4516
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1484 -ip 14841⤵PID:5476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\readme.txt
- Size 1KB
- SHA256 794b3bf63d9ced141ba41a710697230da41b7e75c341d549a3b3359955b7fe6f
- MD5 fdb3ebd9bc1237354dec30a2de9a78ce
- SHA1 255ec3c63ee80545d31d302ea348024c522863f5
- SHA512 ae9600b98a0b1450dc5c0d9a94281104f04770bc758d40270b7a7b4e5b7f5406d36c290676ec59b0d9c43b2d99ab876c8a4fe302e746aa15bf2dd14ade1f6fd7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\0a243cc1235bc425c211cff66067fa82dc6a164884dc060e548b850c38ce1e6d.exe
- Size 719KB
- SHA256 99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
- MD5 3e063dc0de937df5841cb9c2ff3e4651
- SHA1 e683bfaeb1a695ff9ef1759cf1944fa3bb3b6948
- SHA512 9a0d0c04b95bbf8c73beb398cc72fa8e9dc87e3149e8c2f43b05fca4ef8e4410c1d65ed11e50b01d24719ce6a8996448944ab56601ef65116614a17f2e10d23f
- SSDEEP 12288:aKRHZl7Lup6ySk3QYktDNYlg2317DJtY7wdD30qoifK/Ke5ABa4QP9+NrMke03f9:aKslHY7wdD30qnfsKxB+ZKX55WsSuFrl
- MD5 SHA1 SHA512 SSDEEP