Malware Analysis Report

2025-08-05 19:34

Sample ID 221013-z4835sedf9
Target b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d
SHA256 b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d

Threat Level: Known bad

The file b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Neshta family

Neshta

Detect Neshta payload

Modifies system executable filetype association

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-13 21:17

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-13 21:17

Reported

2022-10-14 02:23

Platform

win7-20220812-en

Max time kernel

96s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe"

Signatures

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Neshta

persistence spyware neshta

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\f: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\Windows\Q327979.log \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeBackupPrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeShutdownPrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeSecurityPrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A
Token: SeTakeOwnershipPrivilege N/A \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1668 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe
PID 1640 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe \??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

"C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe"

\??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe

c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe

Network

Country Destination Domain Proto
NL 142.250.179.142:80 tcp
US 172.67.151.226:80 tcp
US 172.67.151.226:443 tcp
US 172.67.151.226:443 tcp

Files

memory/1668-54-0x0000000075071000-0x0000000075073000-memory.dmp

\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

memory/1640-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

memory/1668-62-0x0000000002110000-0x000000000212E000-memory.dmp

memory/1668-63-0x0000000002110000-0x000000000212E000-memory.dmp

memory/1640-64-0x0000000001000000-0x000000000101E000-memory.dmp

\1c28db9f88b9d0211411a6968c36443e\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

memory/1220-66-0x0000000000000000-mapping.dmp

C:\1c28db9f88b9d0211411a6968c36443e\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

\1c28db9f88b9d0211411a6968c36443e\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

\??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

\1c28db9f88b9d0211411a6968c36443e\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

\1c28db9f88b9d0211411a6968c36443e\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

\??\c:\1c28db9f88b9d0211411a6968c36443e\update\update.inf

MD5 ad0328202c8fb53f6c6fc13a4a204801
SHA1 e4b8e689fa23760a1e991777533fef7448b77321
SHA256 06b88504861d7be892f7382af8bc380a8caa2d282d6b12219cee00c561292625
SHA512 0a90cddaf7b05456cde7611b7e4b24f2da97501db8ba015f52593335901722cdd273653c9f4dc42e45b9405c466b55a372498ff5fa038f5fb89603e1df8b8455

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/1640-75-0x0000000001000000-0x000000000101E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-13 21:17

Reported

2022-10-14 02:28

Platform

win10v2004-20220812-en

Max time kernel

150s

Max time network

182s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe"

Signatures

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\f: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A
File opened for modification C:\Windows\Q327979.log \??\c:\62357e4d7090dedcbddd5\update\update.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A \??\c:\62357e4d7090dedcbddd5\update\update.exe N/A
Token: SeRestorePrivilege N/A \??\c:\62357e4d7090dedcbddd5\update\update.exe N/A
Token: SeShutdownPrivilege N/A \??\c:\62357e4d7090dedcbddd5\update\update.exe N/A
Token: SeSecurityPrivilege N/A \??\c:\62357e4d7090dedcbddd5\update\update.exe N/A
Token: SeTakeOwnershipPrivilege N/A \??\c:\62357e4d7090dedcbddd5\update\update.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

"C:\Users\Admin\AppData\Local\Temp\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe"

\??\c:\62357e4d7090dedcbddd5\update\update.exe

c:\62357e4d7090dedcbddd5\update\update.exe

Network

Country Destination Domain Proto
NL 178.79.208.1:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
NL 104.80.224.44:443 tcp
US 8.8.8.8:53 9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

memory/1564-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\b190b4c25e78d93ed9fb8e5946c70b1752e71c5912f9f5cfa938505f4468dc6d.exe

MD5 2711faf13bce14d0139a9f1669c27da3
SHA1 7838088fb05b29e54869d7bc50c10f8536da6cb1
SHA256 d7d9c2a15cbb55f00c41ee55ff60eea6fc34b0f93b1e8506b660dd8e24a38b88
SHA512 541654109ae633de49ca1688df7f85d87188a6559504e28be4b5e1e4939d1c8d4edd429b976de6694419bcd50eea4d03a1908cf8f93643b3d16e10c6cc3d687f

memory/944-135-0x0000000000000000-mapping.dmp

C:\62357e4d7090dedcbddd5\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

\??\c:\62357e4d7090dedcbddd5\update\update.exe

MD5 1ef493cfe59a498a5cbf1cb489f07726
SHA1 7e4b7fbab01247cdac2936586148b902bf190347
SHA256 357c8aa2b1507c02625fbfcd79a382c163b23281be49e753ffe6a522125c0cf3
SHA512 d84c3c26b3b346d6a04f716262436df0aedad94aba86b7db9a2d5d56475c233dc0f8cd3a36f653a301ad9106351ea0045b3dbea2f4e9662497b3263ce1cb42e1

memory/1564-138-0x0000000001000000-0x000000000101E000-memory.dmp

\??\c:\62357e4d7090dedcbddd5\update\update.inf

MD5 ad0328202c8fb53f6c6fc13a4a204801
SHA1 e4b8e689fa23760a1e991777533fef7448b77321
SHA256 06b88504861d7be892f7382af8bc380a8caa2d282d6b12219cee00c561292625
SHA512 0a90cddaf7b05456cde7611b7e4b24f2da97501db8ba015f52593335901722cdd273653c9f4dc42e45b9405c466b55a372498ff5fa038f5fb89603e1df8b8455

memory/1564-140-0x0000000001000000-0x000000000101E000-memory.dmp