neshta | 79b58bb35b6299919e78f166bd42cbd38741c73922c41ee7470b1813e5d09d26

General

Target

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
Size

780KB
MD5

53634e768575e91e9b89543fb47dca4c
SHA1

4151261b147b5b22057dda171b9f024de0b01d46
SHA256

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a
SHA512

49afb63b3f0f3f986365875a450fdadf865822cbc41b62253d2c2b5c96993bf6883096a96927dd9872861f72c31012bd224243a592e39bd009bb3960d3e37f87
SSDEEP

12288:1rfXXHjivz4mL/ybmDw1IwjfkM8aCDwjU3qhiqxjExqMHDFACuvFd:1rfDiyaDw+yMMdC2U6Dw4sDF4

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Loads dropped DLL 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

pid process

2412 7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

pid	process
2412	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	pid	process	target process
PID 2080 set thread context of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Drops file in Program Files directory 64 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Drops file in Windows directory 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description ioc process

File opened for modification C:\Windows\svchost.com 7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2540 schtasks.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

pid	process
2540	schtasks.exe

Modifies registry class 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2568 powershell.exe
2620 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2568 powershell.exe
Token: SeDebugPrivilege 2620 powershell.exe

pid	process
2568	powershell.exe
2620	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	pid	process	target process
PID 2080 wrote to memory of 2620	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2620	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2620	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2620	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2568	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2568	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2568	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2568	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 2080 wrote to memory of 2540	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 2080 wrote to memory of 2540	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 2080 wrote to memory of 2540	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 2080 wrote to memory of 2540	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 2080 wrote to memory of 2412	2080	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
"C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JdlPFHWpQXC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JdlPFHWpQXC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D65.tmp"
2⤵
- Creates scheduled task(s)
PID:2540

C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
"C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe"
2⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2412

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

Scheduled Task/Job

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4D65.tmp
Filesize
1KB

MD5
43783d2a3768b9f7b55a66436ebd01df

SHA1
7b236a8537c0996f6d1228580afc8a5554534a1b

SHA256
3c315963e3d3360d898493d7592eb7f822c1bcd630d508500afe5e474ba56743

SHA512
a58dcbdcd5da82d556a6829f6c727a0d284feacee2e563bcc9fd67f79e977f9df7cddd0c4a5c1768ba7e51a4fc9fddc450cdd9f1cb4ef7bcf07a075bd483fb21

Download Submit
C:\Users\Admin\AppData\Roaming\JDLPFH~1.EXE
Filesize
780KB

MD5
53634e768575e91e9b89543fb47dca4c

SHA1
4151261b147b5b22057dda171b9f024de0b01d46

SHA256
7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a

SHA512
49afb63b3f0f3f986365875a450fdadf865822cbc41b62253d2c2b5c96993bf6883096a96927dd9872861f72c31012bd224243a592e39bd009bb3960d3e37f87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
759f400d1d9e39ae91352dd6005e8afd

SHA1
93c8871d522457ffa197504968554ec046752aae

SHA256
406cab106d8867a246ec26a399a3916c38c2c2d67edd83411bc61b788a55e303

SHA512
1b8a3c8208dec3f08814afc44d5c06490a098f73af64083744d94bdebda7ac1ee095d58581ca4f611f43593fd6978c6a1a51b35dbdb3e74c1107e331ce900858

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
f605c7dcb3ec017d4f7e48b450adb998

SHA1
eeeea0d6f923c82f3f3490deba323ee5121cda13

SHA256
22614585cebaadfe4332322c0fcd368fd402bbca8e83e7fe90e59a2bf993275b

SHA512
b264681b2856a4e71fbee7d88369fc2165bb5ba930a50aac4f2e6e6e40a0245cf3a407ae1120a771c1357163b221b6a2d60fe13aaa5573f98a4bbde0bb778379

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
memory/2080-3-0x0000000000950000-0x0000000000964000-memory.dmp

Filesize
80KB

Download
memory/2080-6-0x0000000005FB0000-0x0000000006036000-memory.dmp

Filesize
536KB

Download
memory/2080-5-0x00000000009E0000-0x00000000009EC000-memory.dmp

Filesize
48KB

Download
memory/2080-4-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/2080-0-0x0000000001360000-0x000000000142A000-memory.dmp

Filesize
808KB

Download
memory/2080-2-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2080-1-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2080-30-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2412-29-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-48-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-28-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-22-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-31-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-21-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-127-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-20-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-24-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2568-45-0x000000006E620000-0x000000006EBCB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-50-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2568-51-0x000000006E620000-0x000000006EBCB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-43-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2568-39-0x000000006E620000-0x000000006EBCB000-memory.dmp

Filesize
5.7MB

Download
memory/2620-46-0x000000006E620000-0x000000006EBCB000-memory.dmp

Filesize
5.7MB

Download
memory/2620-47-0x0000000000450000-0x0000000000490000-memory.dmp

Filesize
256KB

Download
memory/2620-44-0x0000000000450000-0x0000000000490000-memory.dmp

Filesize
256KB

Download
memory/2620-49-0x0000000000450000-0x0000000000490000-memory.dmp

Filesize
256KB

Download
memory/2620-52-0x000000006E620000-0x000000006EBCB000-memory.dmp

Filesize
5.7MB

Download
memory/2620-42-0x000000006E620000-0x000000006EBCB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads