Malware Analysis Report

2024-11-16 12:20

Sample ID 240415-f1e64sff27
Target SecuriteInfo.com.Heur.22008.21824.exe
SHA256 aec8415d0972e902d53d348ebc7beaf6c575f9ec6e12791173ab1d84e90a1109
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aec8415d0972e902d53d348ebc7beaf6c575f9ec6e12791173ab1d84e90a1109

Threat Level: Known bad

The file SecuriteInfo.com.Heur.22008.21824.exe was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Detect Neshta payload

Neshta

Loads dropped DLL

Modifies system executable filetype association

Checks computer location settings

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-15 05:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-15 05:20

Reported

2024-04-15 05:22

Platform

win7-20240221-en

Max time kernel

121s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2032 set thread context of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2032 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 2032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iZwbTl.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iZwbTl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D4E.tmp"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

Network

N/A

Files

memory/2032-0-0x0000000001390000-0x000000000145C000-memory.dmp

memory/2032-1-0x0000000074800000-0x0000000074EEE000-memory.dmp

memory/2032-2-0x0000000001260000-0x00000000012A0000-memory.dmp

memory/2032-3-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2032-4-0x00000000005C0000-0x00000000005C8000-memory.dmp

memory/2032-5-0x0000000000620000-0x000000000062C000-memory.dmp

memory/2032-6-0x0000000005330000-0x00000000053BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3D4E.tmp

MD5 9b749d1f3176652e92d825d54e481294
SHA1 32adb6ef07bb0fa3a8328e9f45bb28c936f75492
SHA256 11fdac4f4d318f8b832086ac904f3e9d0f5c0c6edb0f1a0bc948243e95687fb6
SHA512 b9d0b7b252b0ecbf0c2bacbe6900e901d1b74da3bbcdfe94eadd4fcd70addc39634c127af4c4ca795f74313e8addce692fbb34e6a5600fe85102390bd3210582

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 a85ffa2592eeeb7f950f27a15dd789c6
SHA1 72d37b0ef22e503541821575c7221515735ae86d
SHA256 3024759d8902774dd5e906fce3b428f4971a44db9832c84df82e75b1d1c46bac
SHA512 bb29fbeb9c6df6b006fe5ab99833ee0fb63be0bf74bc93b0bde4598ec18c77228a807bdc5ddc904c4d78e8f4d08906125ef557268a8f701273b46bacbba4811f

memory/2200-19-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-21-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-23-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-25-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-29-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-31-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2200-35-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-37-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2032-39-0x0000000074800000-0x0000000074EEE000-memory.dmp

C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

MD5 85bffd716be6e64702dc8e2693af927a
SHA1 d58f548346ab9fa505123436417ca1641afd35e0
SHA256 2059609260ddce07580c17c044132f2c5c575b1db6afb39be627ace39c4f0623
SHA512 d0f4cdf19dbcad6b6259994eeac6dcb2a56360cd807fcad61e73aa1eb3724ade0fe3b10e63724387fe816c8751ba2ca66e69deef64eaecfd9d3594214e0a8761

memory/2676-43-0x000000006E930000-0x000000006EEDB000-memory.dmp

memory/2676-49-0x0000000002880000-0x00000000028C0000-memory.dmp

memory/3024-50-0x00000000026F0000-0x0000000002730000-memory.dmp

memory/3024-48-0x000000006E930000-0x000000006EEDB000-memory.dmp

memory/2676-51-0x000000006E930000-0x000000006EEDB000-memory.dmp

memory/2676-54-0x0000000002880000-0x00000000028C0000-memory.dmp

memory/3024-55-0x00000000026F0000-0x0000000002730000-memory.dmp

memory/2200-53-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2676-56-0x0000000002880000-0x00000000028C0000-memory.dmp

memory/3024-52-0x000000006E930000-0x000000006EEDB000-memory.dmp

memory/3024-58-0x000000006E930000-0x000000006EEDB000-memory.dmp

memory/2676-57-0x000000006E930000-0x000000006EEDB000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Users\Admin\AppData\Roaming\iZwbTl.exe

MD5 5d84f160cec1c7b8e83d6d9f90a612f0
SHA1 58f2e9216d4b29073376f6f607c16d03ba1c200f
SHA256 aec8415d0972e902d53d348ebc7beaf6c575f9ec6e12791173ab1d84e90a1109
SHA512 fd2c641a4d4a244b77ad0ce8870958fa05bf766bba65c08e0cabfd652d12e43367dfeb9ee2969e74fd95658a10d015738a6449f3da1f4148d953163c5ff4ccb7

memory/2200-133-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-15 05:20

Reported

2024-04-15 05:22

Platform

win10v2004-20240412-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4576 set thread context of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4576 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 4576 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 4576 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Windows\SysWOW64\schtasks.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe
PID 4576 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iZwbTl.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iZwbTl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp954B.tmp"

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.22008.21824.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 193.98.74.40.in-addr.arpa udp

Files

memory/4576-0-0x0000000074FA0000-0x0000000075750000-memory.dmp

memory/4576-1-0x0000000000BB0000-0x0000000000C7C000-memory.dmp

memory/4576-2-0x0000000005C80000-0x0000000006224000-memory.dmp

memory/4576-3-0x00000000056D0000-0x0000000005762000-memory.dmp

memory/4576-4-0x0000000005940000-0x0000000005950000-memory.dmp

memory/4576-5-0x0000000005660000-0x000000000566A000-memory.dmp

memory/4576-6-0x0000000005B00000-0x0000000005B12000-memory.dmp

memory/4576-7-0x0000000005C30000-0x0000000005C38000-memory.dmp

memory/4576-8-0x0000000005C40000-0x0000000005C4C000-memory.dmp

memory/4576-9-0x0000000006C20000-0x0000000006CAC000-memory.dmp

memory/4576-10-0x000000000A610000-0x000000000A6AC000-memory.dmp

memory/1756-15-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

memory/1756-16-0x0000000074FA0000-0x0000000075750000-memory.dmp

memory/1756-17-0x0000000005CC0000-0x00000000062E8000-memory.dmp

memory/3492-18-0x0000000074FA0000-0x0000000075750000-memory.dmp

memory/3492-19-0x00000000046B0000-0x00000000046C0000-memory.dmp

memory/3492-20-0x00000000046B0000-0x00000000046C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp954B.tmp

MD5 fcb9917f761a80c7cf23d4365d707f69
SHA1 f09e2e33a47ece2d134ebd7e5840a935945560fc
SHA256 1f97b92d48a6f928117dd0f06500163af09760ab7205e09ac39655ac5193cd86
SHA512 13acda0f29da643b059b2867469be8264d3a1631c87033d9a095b74838cfa594e1a587cb7abd2b411e1ba7304d9f9c6324d0521a2800dcbab68f6b1fa0267500

memory/1756-22-0x0000000005680000-0x0000000005690000-memory.dmp

memory/3492-23-0x0000000004C10000-0x0000000004C32000-memory.dmp

memory/3492-24-0x0000000005490000-0x00000000054F6000-memory.dmp

memory/1756-30-0x0000000005C00000-0x0000000005C66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5qsdmy2.air.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4812-35-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4812-45-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1756-48-0x00000000062F0000-0x0000000006644000-memory.dmp

memory/4812-46-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4812-51-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4576-50-0x0000000074FA0000-0x0000000075750000-memory.dmp

memory/3492-52-0x0000000005B00000-0x0000000005B1E000-memory.dmp

memory/3492-53-0x0000000006090000-0x00000000060DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\SecuriteInfo.com.Heur.22008.21824.exe

MD5 4b545f6eee3efe6ae2d162bfc67088fa
SHA1 2bba052522b3d8570df7f8875f2f3b9d496841f3
SHA256 de1a598505c47afc57ccd600c4c14ba710d1ab38ee12d696dfe8e30de7f3a1cf
SHA512 5c2d61fafe743f50227e04d67b66506cc0059511dec8896ef8cab1f746f8e699c06a5d56bf830fc09a9a4cce9cca084ebabec187d05c5f27e4004000a59e29ec

memory/3492-63-0x00000000046B0000-0x00000000046C0000-memory.dmp

memory/1756-64-0x0000000005680000-0x0000000005690000-memory.dmp

memory/3492-65-0x000000007F7B0000-0x000000007F7C0000-memory.dmp

memory/3492-66-0x0000000006AD0000-0x0000000006B02000-memory.dmp

memory/3492-67-0x0000000075810000-0x000000007585C000-memory.dmp

memory/3492-77-0x0000000006050000-0x000000000606E000-memory.dmp

memory/3492-78-0x0000000006D10000-0x0000000006DB3000-memory.dmp

memory/1756-79-0x000000007F420000-0x000000007F430000-memory.dmp

memory/1756-80-0x0000000075810000-0x000000007585C000-memory.dmp

memory/1756-91-0x00000000079D0000-0x00000000079EA000-memory.dmp

memory/3492-90-0x0000000007450000-0x0000000007ACA000-memory.dmp

memory/1756-92-0x0000000007A40000-0x0000000007A4A000-memory.dmp

memory/1756-93-0x0000000007EF0000-0x0000000007F86000-memory.dmp

memory/3492-94-0x0000000007010000-0x0000000007021000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5 d0576024112e5882d907f2ef2ede2982
SHA1 61117ee60c3c0028eedec1edbf9275611b2ec404
SHA256 c27a5efcc3a73e6b80d177e358f746b0d05f9e8bc917686e84c8ddd8c6133fe5
SHA512 fd84b035cec0a880099febdddddf05763407a59905a8913055184f71ca5d557157bc51930a277ab8c411f5be56077df38c8f3580c4bdd6a4560792115336ea32

memory/3492-109-0x0000000007060000-0x000000000706E000-memory.dmp

memory/3492-110-0x0000000007070000-0x0000000007084000-memory.dmp

memory/3492-111-0x0000000007170000-0x000000000718A000-memory.dmp

memory/1756-112-0x0000000007E80000-0x0000000007E88000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 90aed2ed6a32df35763ffa4002c7b03d
SHA1 841b64e3dc8a0c93d86b9f6defe53b421a0a2fa2
SHA256 f3b3ffe99f601c42e118bcb43da50641dbb1c11c2e0467af0b20539e79905593
SHA512 eb01d7c421b65e483d34abb66046588a111d05b44feab64003c30dd60ba290078d9c2e62debb7477c82feab2c0b108867b5fe6f7bd1dcdc51a3036e1f1fbca70

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3492-156-0x0000000074FA0000-0x0000000075750000-memory.dmp

memory/1756-166-0x0000000074FA0000-0x0000000075750000-memory.dmp

C:\Users\Admin\AppData\Roaming\iZwbTl.exe

MD5 5d84f160cec1c7b8e83d6d9f90a612f0
SHA1 58f2e9216d4b29073376f6f607c16d03ba1c200f
SHA256 aec8415d0972e902d53d348ebc7beaf6c575f9ec6e12791173ab1d84e90a1109
SHA512 fd2c641a4d4a244b77ad0ce8870958fa05bf766bba65c08e0cabfd652d12e43367dfeb9ee2969e74fd95658a10d015738a6449f3da1f4148d953163c5ff4ccb7

memory/4812-194-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4812-196-0x0000000000400000-0x000000000041B000-memory.dmp