neshta | 948c1e7f771462f59f702de527e0ebf6c109bf9762284a9a54a91f08700d8404

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
Size

385KB
MD5

1ef7be727d7656f45d19cae632732fb4
SHA1

26d61d189673722854181594594a74348eb3a952
SHA256

948c1e7f771462f59f702de527e0ebf6c109bf9762284a9a54a91f08700d8404
SHA512

0b933f2a1a53840fef5deb834e6c8c22853910e6503d9f7191a91a3ac05722a225d1d17684107d5c6615356ece425b57b3aa7898cd066556f667954713356227
SSDEEP

6144:09BUwrQ9Ey4sxZZQttyCVxaWYSda4bHPS9x6qr6jDRPWHz6kp62kVCRjCK:GkEfeAtpVxag1bvgx6NdC62kVsjV

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Loads dropped DLL 1 IoCs

Processes:

1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

pid process

3000 1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1546.001

Processes:

1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3000	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\svchost.com 1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ef7be727d7656f45d19cae632732fb4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:3000

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
Filesize
547KB

MD5
1df04fcceae31b4330e6657a3e5f9a8e

SHA1
6a5e0567d50870f14ce807a32d2d04c5befb380d

SHA256
e9cfcec552ebad98f0d27223ff78532b14bb9c82e2a9d211aca3eb4d1ca741ac

SHA512
04ac5bf26ff1a7f7fa98680fa115ac51ef416e93a959b9e371411544a9cd6012ba5efa489b2401b7e79566e3e9d0826d70092029b6ba3e049b4f3b9f87b634ab

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
memory/3000-79-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3000-83-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads