Malware Analysis Report

2024-11-16 12:20

Sample ID 240416-k1r8wsea33
Target PO0130717.zip
SHA256 345c9e1d0f7acf8e08d4831daacc56a1c8c57299c75895fb0783c891750eb509
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

345c9e1d0f7acf8e08d4831daacc56a1c8c57299c75895fb0783c891750eb509

Threat Level: Known bad

The file PO0130717.zip was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Neshta

Detect Neshta payload

Reads user/profile data of web browsers

Modifies system executable filetype association

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-16 09:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-16 09:04

Reported

2024-04-16 09:06

Platform

win7-20240319-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2124 set thread context of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2124 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 2124 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 2124 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 2124 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 2124 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

"C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hiOUFxAiUxx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hiOUFxAiUxx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp"

C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

"C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

Network

N/A

Files

memory/2124-0-0x0000000000810000-0x00000000008CC000-memory.dmp

memory/2124-1-0x0000000073BE0000-0x00000000742CE000-memory.dmp

memory/2124-2-0x0000000004830000-0x0000000004870000-memory.dmp

memory/2124-3-0x0000000004BD0000-0x0000000004C78000-memory.dmp

memory/2124-4-0x0000000000360000-0x0000000000372000-memory.dmp

memory/2124-5-0x0000000000420000-0x0000000000428000-memory.dmp

memory/2124-6-0x00000000004B0000-0x00000000004BC000-memory.dmp

memory/2124-7-0x0000000004D80000-0x0000000004E0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp64FA.tmp

MD5 0ff3d6cd843da975be4ee327cef1cec1
SHA1 fe01d790e009ad560def00e0a2e21eeda6277daa
SHA256 73a10aee81f3e3b95fe953158f87b5cd89109c50dee8f85abb3ef3f3b222358a
SHA512 d091ed2a3e744b720bef429ffd90dc333f2bb2173733d531d768f3a0cf2c9bd81dd9c2b33e198a910e780faece8466eb1c624a3672bc03d9ce938050c74bb295

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YEZOXI87M2L8OS6MI55V.temp

MD5 aece20adf93a9d2f49ddf24e36d88bf6
SHA1 3033b85c6bde47da9258682fcc3f6e5e4e8a38e0
SHA256 c809de5deabf690074be2fd4b0254a658abd65b58a8821aa8c09f0a7205d1d3b
SHA512 3e1390618ea71d2f37cdd3664a00e0af689cc1e0a5edcb94a35e9683af060bd3267a63d935dbea27d72660972d09e9fdf0d39c55c207d20108df910c461c3624

memory/3008-21-0x000000006EA30000-0x000000006EFDB000-memory.dmp

memory/2512-23-0x000000006EA30000-0x000000006EFDB000-memory.dmp

memory/3008-25-0x0000000002710000-0x0000000002750000-memory.dmp

memory/2512-27-0x000000006EA30000-0x000000006EFDB000-memory.dmp

memory/3008-29-0x000000006EA30000-0x000000006EFDB000-memory.dmp

memory/2512-31-0x00000000026D0000-0x0000000002710000-memory.dmp

memory/2512-33-0x00000000026D0000-0x0000000002710000-memory.dmp

memory/2900-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3008-37-0x0000000002710000-0x0000000002750000-memory.dmp

memory/2900-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2900-39-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2124-38-0x0000000073BE0000-0x00000000742CE000-memory.dmp

memory/2900-32-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2900-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2900-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2900-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2900-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2900-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2900-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2512-40-0x000000006EA30000-0x000000006EFDB000-memory.dmp

memory/3008-41-0x000000006EA30000-0x000000006EFDB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-16 09:04

Reported

2024-04-16 09:07

Platform

win10v2004-20240412-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 800 set thread context of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO0130717.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 800 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 800 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 800 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 800 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 800 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 800 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 800 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 800 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 800 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Windows\SysWOW64\schtasks.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe
PID 800 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\PO0130717.exe C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

"C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hiOUFxAiUxx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hiOUFxAiUxx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA894.tmp"

C:\Users\Admin\AppData\Local\Temp\PO0130717.exe

"C:\Users\Admin\AppData\Local\Temp\PO0130717.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 132.250.30.184.in-addr.arpa udp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

memory/800-1-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/800-0-0x0000000000580000-0x000000000063C000-memory.dmp

memory/800-2-0x00000000056B0000-0x0000000005C54000-memory.dmp

memory/800-3-0x0000000005010000-0x00000000050A2000-memory.dmp

memory/800-4-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

memory/800-5-0x00000000050E0000-0x00000000050EA000-memory.dmp

memory/800-6-0x0000000006260000-0x0000000006308000-memory.dmp

memory/800-7-0x00000000051B0000-0x00000000051C2000-memory.dmp

memory/800-8-0x00000000053E0000-0x00000000053E8000-memory.dmp

memory/800-9-0x0000000005670000-0x000000000567C000-memory.dmp

memory/800-10-0x0000000006340000-0x00000000063CC000-memory.dmp

memory/800-11-0x0000000008AE0000-0x0000000008B7C000-memory.dmp

memory/3588-16-0x0000000002B80000-0x0000000002BB6000-memory.dmp

memory/3588-17-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/3588-18-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

memory/3588-20-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

memory/3588-19-0x0000000005660000-0x0000000005C88000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA894.tmp

MD5 fbddc30da5102945b4bc9dedfcc55941
SHA1 225a61a265b121bab2bbd16642c2c8153d70146e
SHA256 1e9af1fefe828c1bb7d997107ab2c964c97df38ab516dfc5191d2b30174c362f
SHA512 f39d137f780acf37ca98c76224b4e0da132d427691f811a5eb927fcc983f2015a8c43bdd828689f3614906209b214e1a7def493b08647f19525ac6e279011a1b

memory/408-22-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/408-23-0x0000000003010000-0x0000000003020000-memory.dmp

memory/800-25-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/3588-24-0x00000000054E0000-0x0000000005502000-memory.dmp

memory/408-27-0x0000000003010000-0x0000000003020000-memory.dmp

memory/3588-26-0x0000000005D40000-0x0000000005DA6000-memory.dmp

memory/3972-29-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swx4r1x5.mvo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3972-35-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3972-41-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3972-53-0x0000000000400000-0x000000000041B000-memory.dmp

memory/800-55-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

memory/800-54-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/3588-42-0x0000000005ED0000-0x0000000006224000-memory.dmp

memory/3588-28-0x0000000005E60000-0x0000000005EC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\PO0130717.exe

MD5 d9861436812dcd12d184cc62640e9261
SHA1 2174e40f48b48311edbc22b285aed597d12d8edd
SHA256 bd0188dd00359c6e23c9486155b0a87051584f3e8ba11339e73b2e0029dcfeb8
SHA512 db4ad376082d47f5ab496252a3448f9e76c42b4becab3d9b30034d779c7bc0e0d3a027f2412752e69b23e4de90af0e32cfcb286c8743450e3e016dd6f67bcee6

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5 1b3fa69faa216594f3c46797b1a8acda
SHA1 60fedfb10d22edb84732efd08dd1d6cfd9248729
SHA256 07047e37afcd4e84bfb1937f5cfeb799b1ba24761a4d08fca0a440b5cf8cbe17
SHA512 44bfe3cb5f4b2a7d56daae9734e92747444a2bc0c6382c72aaba9ed732a51b6e167ad489058e1bbb212d7750d598d60d1b0f8f6b0f6f6f00ec8aed862a851274

memory/408-79-0x0000000006950000-0x000000000696E000-memory.dmp

memory/408-80-0x00000000069F0000-0x0000000006A3C000-memory.dmp

memory/408-144-0x0000000003010000-0x0000000003020000-memory.dmp

memory/3588-143-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

C:\Users\Admin\AppData\Roaming\HIOUFX~1.EXE

MD5 a91dab24aa90fa6115cd9a6d496aef47
SHA1 f6713efef793510d67b672eb85e52582e02be38c
SHA256 179e9673e3cbfd035d528f744f3eb88c65583089bb78d744f2c380be3bf3540a
SHA512 99c00a94d63d316208b8fe3e1a247cd95662348d85e713080f6de8c5a496161f04a30b7a9373aa1ee62cc3fef25244cf735d70f84d10a0bfd87547f6dbe5adec

memory/408-157-0x0000000007920000-0x0000000007952000-memory.dmp

memory/3588-158-0x0000000075B30000-0x0000000075B7C000-memory.dmp

memory/408-159-0x0000000075B30000-0x0000000075B7C000-memory.dmp

memory/3588-178-0x0000000005220000-0x000000000523E000-memory.dmp

memory/3588-179-0x00000000076B0000-0x0000000007753000-memory.dmp

memory/408-180-0x00000000082E0000-0x000000000895A000-memory.dmp

memory/408-181-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

memory/3588-182-0x0000000007860000-0x000000000786A000-memory.dmp

memory/408-183-0x0000000007F20000-0x0000000007FB6000-memory.dmp

memory/408-184-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

memory/3588-185-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/408-186-0x0000000007ED0000-0x0000000007EDE000-memory.dmp

memory/3588-187-0x0000000007A30000-0x0000000007A44000-memory.dmp

memory/408-188-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

memory/3588-189-0x0000000007B10000-0x0000000007B18000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a5f2240a07ba615a3dc131882ed2f7ee
SHA1 88313230355ecb160ab47934205f8175e1220f2a
SHA256 8ef5765bd4e21b037aa17d6b9a873de405888ee781af2e34fff6bd2eec40cf20
SHA512 691c135befadd5a05bf1b7696e4e8e4e47713e9887aaf9aef15cb669846ffb29ee818624f48953bed1e4fb2f74a53a149905de66b513db6e9653c3735cf0d8a0

memory/3588-195-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/408-196-0x0000000075280000-0x0000000075A30000-memory.dmp

memory/3972-197-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3972-199-0x0000000000400000-0x000000000041B000-memory.dmp