neshta | 69c69877f1db7e532fcadee4c12cbb47943aba7cf67cd0e66c8605d382cbe5bf

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
Size

787KB
MD5

a40f32931f347c2a295c3169a0d90049
SHA1

ff3cd9ab41aefdc39297041ac22a279bcb6421fb
SHA256

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a
SHA512

f666a0be054eb649882a5ad86d3fac609df33f96ded2b7fe76975bba44b477ce2c9eed081939dc20bd6bb8d25dccbc375de8afd57a6139eefb1e2213c144181f
SSDEEP

12288:rVcNBnF9MerEqHIXgR6pMWDZFSKrL38OnabJufBPr7T4n6+p:pcNFjMtXEvKv38moJuZD7T

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1432-46-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1432-47-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1432-49-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1432-52-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1432-194-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1432-196-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description	pid	process	target process
PID 2684 set thread context of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

Drops file in Program Files directory 64 IoCs

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI9C33~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~4.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

Drops file in Windows directory 1 IoCs

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description ioc process

File opened for modification C:\Windows\svchost.com 849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1148 schtasks.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

pid	process
1148	schtasks.exe

Modifies registry class 1 IoCs

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4888 powershell.exe
3776 powershell.exe
3776 powershell.exe
4888 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3776 powershell.exe
Token: SeDebugPrivilege 4888 powershell.exe

pid	process
4888	powershell.exe
3776	powershell.exe
3776	powershell.exe
4888	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

description	pid	process	target process
PID 2684 wrote to memory of 3776	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	powershell.exe
PID 2684 wrote to memory of 3776	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	powershell.exe
PID 2684 wrote to memory of 3776	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	powershell.exe
PID 2684 wrote to memory of 4888	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	powershell.exe
PID 2684 wrote to memory of 4888	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	powershell.exe
PID 2684 wrote to memory of 4888	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	powershell.exe
PID 2684 wrote to memory of 1148	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	schtasks.exe
PID 2684 wrote to memory of 1148	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	schtasks.exe
PID 2684 wrote to memory of 1148	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	schtasks.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
PID 2684 wrote to memory of 1432	2684	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe	849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe

C:\Users\Admin\AppData\Local\Temp\849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
"C:\Users\Admin\AppData\Local\Temp\849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JbEQlGryO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JbEQlGryO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADE3.tmp"
2⤵
- Creates scheduled task(s)
PID:1148

C:\Users\Admin\AppData\Local\Temp\849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
"C:\Users\Admin\AppData\Local\Temp\849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe"
2⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Filesize
328KB

MD5
54f7f2bed41d28f265fbbcc19b6b15a8

SHA1
98aeca3e0dfc62ba4953d3c971caae7c3d28483d

SHA256
b983a215d334d93b80b551b272d0a09bea595eaae340efa5bae28d2a381c25ab

SHA512
be82df7a019e05a5d2da55bda1c4ab83ed7d88f72a273f721c01f0bd0b62adb3d28f07376043145158f4c75fb7aa45ebebb6bfe5f4a534f1e4767a6f86b8a118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
6ad18fa677963120a172adf8f3f5700e

SHA1
391762c3df0d4a4f220bf86fd28902b5defd6aa9

SHA256
c9d7680454456f2d07f59e67f8df284e027d09ae681de6005d355aa350858cb0

SHA512
f46bfd59ec0f2b941ecc941b3dedc193171bdd29cd3d0b634a444af50561996c24fa252660cdd8f2dddc1ace3b78c336dc68bcd234be7d4c36703c429d677cea

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a.exe
Filesize
747KB

MD5
5126bc679b773544dd3f0e3acda00766

SHA1
9d249c48b5c4a49bd9332fa78537e82144a4b556

SHA256
615aac452ae57ce28563caac8f6c714d3ae288b184ea4c516df0a2187225b472

SHA512
4e0d3fe57bb40cd3f0c0e86ad5377365fb96f65787a05eca89ae92eb89bdf396344936a4879eca2928c55dfd546c99a452c5cd624ae9edc84840e7f5dc361d40

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hh5vmrxm.bdh.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpADE3.tmp
Filesize
1KB

MD5
9807d73704d222253fa6b478469e7816

SHA1
59eab036d19e3cb882b422e951480faf4204cdd3

SHA256
471b2a8a85cbcc160249ebc6dad31a35bebb9e95174dedf4869558f7c98b1318

SHA512
e90936487002fa159466074ccea46363c1a1a18829ef041c72e8146cd2ca8e4bb539bfdf2d64a40b28d6a6fce47f617b28626665f5d8cc476812678d0a9840c0

Download Submit
C:\Users\Admin\AppData\Roaming\JBEQLG~1.EXE
Filesize
787KB

MD5
a40f32931f347c2a295c3169a0d90049

SHA1
ff3cd9ab41aefdc39297041ac22a279bcb6421fb

SHA256
849f8e0fe82c9e9606234c3c6018ca5f94f063d90bf00e9d551002276485892a

SHA512
f666a0be054eb649882a5ad86d3fac609df33f96ded2b7fe76975bba44b477ce2c9eed081939dc20bd6bb8d25dccbc375de8afd57a6139eefb1e2213c144181f

Download Submit
memory/1432-194-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1432-52-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1432-47-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1432-49-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1432-196-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1432-46-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2684-7-0x0000000006C50000-0x0000000006C58000-memory.dmp

Filesize
32KB

Download
memory/2684-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2684-6-0x0000000006C30000-0x0000000006C42000-memory.dmp

Filesize
72KB

Download
memory/2684-5-0x0000000005920000-0x000000000592A000-memory.dmp

Filesize
40KB

Download
memory/2684-4-0x0000000005A60000-0x0000000005A70000-memory.dmp

Filesize
64KB

Download
memory/2684-3-0x0000000005860000-0x00000000058F2000-memory.dmp

Filesize
584KB

Download
memory/2684-2-0x0000000005EC0000-0x0000000006464000-memory.dmp

Filesize
5.6MB

Download
memory/2684-8-0x0000000006C60000-0x0000000006C6C000-memory.dmp

Filesize
48KB

Download
memory/2684-51-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/2684-10-0x000000000A830000-0x000000000A8CC000-memory.dmp

Filesize
624KB

Download
memory/2684-1-0x0000000000DC0000-0x0000000000E8C000-memory.dmp

Filesize
816KB

Download
memory/2684-9-0x0000000006D30000-0x0000000006DBC000-memory.dmp

Filesize
560KB

Download
memory/3776-18-0x0000000005130000-0x0000000005758000-memory.dmp

Filesize
6.2MB

Download
memory/3776-135-0x0000000007450000-0x0000000007458000-memory.dmp

Filesize
32KB

Download
memory/3776-26-0x00000000057D0000-0x0000000005836000-memory.dmp

Filesize
408KB

Download
memory/3776-15-0x00000000024C0000-0x00000000024F6000-memory.dmp

Filesize
216KB

Download
memory/3776-24-0x0000000004E20000-0x0000000004E42000-memory.dmp

Filesize
136KB

Download
memory/3776-55-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/3776-16-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/3776-63-0x00000000063F0000-0x000000000643C000-memory.dmp

Filesize
304KB

Download
memory/3776-64-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3776-17-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3776-67-0x000000007F200000-0x000000007F210000-memory.dmp

Filesize
64KB

Download
memory/3776-173-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/3776-19-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3776-78-0x0000000071260000-0x00000000712AC000-memory.dmp

Filesize
304KB

Download
memory/3776-119-0x0000000007360000-0x000000000736E000-memory.dmp

Filesize
56KB

Download
memory/3776-89-0x0000000007010000-0x00000000070B3000-memory.dmp

Filesize
652KB

Download
memory/3776-90-0x0000000007750000-0x0000000007DCA000-memory.dmp

Filesize
6.5MB

Download
memory/3776-91-0x0000000006050000-0x000000000606A000-memory.dmp

Filesize
104KB

Download
memory/3776-92-0x00000000071A0000-0x00000000071AA000-memory.dmp

Filesize
40KB

Download
memory/4888-41-0x0000000005870000-0x0000000005BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4888-21-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/4888-108-0x00000000073B0000-0x00000000073C1000-memory.dmp

Filesize
68KB

Download
memory/4888-79-0x0000000006460000-0x000000000647E000-memory.dmp

Filesize
120KB

Download
memory/4888-127-0x00000000073F0000-0x0000000007404000-memory.dmp

Filesize
80KB

Download
memory/4888-132-0x00000000074F0000-0x000000000750A000-memory.dmp

Filesize
104KB

Download
memory/4888-105-0x0000000007430000-0x00000000074C6000-memory.dmp

Filesize
600KB

Download
memory/4888-20-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/4888-177-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/4888-66-0x0000000006E50000-0x0000000006E82000-memory.dmp

Filesize
200KB

Download
memory/4888-68-0x0000000071260000-0x00000000712AC000-memory.dmp

Filesize
304KB

Download
memory/4888-65-0x000000007F8E0000-0x000000007F8F0000-memory.dmp

Filesize
64KB

Download
memory/4888-22-0x0000000074E00000-0x00000000755B0000-memory.dmp

Filesize
7.7MB

Download
memory/4888-25-0x0000000004E30000-0x0000000004E96000-memory.dmp

Filesize
408KB

Download