Malware Analysis Report

2025-08-05 16:16

Sample ID 240521-b7271aef6x
Target fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe
SHA256 fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0
Tags
agenttesla execution keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0

Threat Level: Known bad

The file fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla execution keylogger persistence spyware stealer trojan

AgentTesla

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects executables referencing many email and collaboration clients. Observed in information stealers

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables referencing many file transfer clients. Observed in information stealers

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 01:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 01:47

Reported

2024-05-21 01:50

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2224 set thread context of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 2224 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 2224 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 2224 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2224 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe

"C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NNSwwLIbU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNSwwLIbU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBE5.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/2224-4-0x00000000003A0000-0x00000000003AC000-memory.dmp

memory/2224-3-0x0000000000610000-0x0000000000632000-memory.dmp

memory/2224-2-0x0000000073F20000-0x000000007460E000-memory.dmp

memory/2224-1-0x00000000011B0000-0x000000000126A000-memory.dmp

memory/2224-0-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

memory/2224-5-0x00000000003C0000-0x00000000003D0000-memory.dmp

memory/2224-6-0x00000000004D0000-0x0000000000554000-memory.dmp

memory/2224-7-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEBE5.tmp

MD5 290227e039d7f55c25c65668e820e9c8
SHA1 ae0f2d03e2045f7a57f3a9126f7bb59826f5a7b4
SHA256 0c705db970da6d5c9bf7b956be40e3e7e40a2845feba62abd1809195c4932aab
SHA512 b0239db5c9190197296d2c3bfa5180f5bed2bb2a298ecf92eae441ac80cee801965f5eea80099a9513a46bb09665cb7171e88dd73e857a726082e29eb68d69c4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N0IQZTKZX2U8IWDZ7E3E.temp

MD5 1ead6e52a14a32e2b65bb538cf678549
SHA1 2e2c131f2da965b5b15b2302e140c941cde10a1f
SHA256 a01ea217a933fb672a420dc1b3638a6b66db673cc8c313d3686c4d53fe40cd3c
SHA512 1e1743de9fc2f3eb8b573ae45b278dbc5548bc9bb73718cb86170699b76d6e2ff4d95a043bea15e0295355f515969d04c771ded75a0c06ffa7c82229e46a9939

memory/928-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/928-31-0x0000000000400000-0x0000000000442000-memory.dmp

memory/928-30-0x0000000000400000-0x0000000000442000-memory.dmp

memory/928-29-0x0000000000400000-0x0000000000442000-memory.dmp

memory/928-27-0x0000000000400000-0x0000000000442000-memory.dmp

memory/928-24-0x0000000000400000-0x0000000000442000-memory.dmp

memory/928-22-0x0000000000400000-0x0000000000442000-memory.dmp

memory/928-20-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2224-32-0x0000000073F20000-0x000000007460E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 01:47

Reported

2024-05-21 01:50

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 388 set thread context of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 388 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 388 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 388 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 388 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 388 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 388 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 388 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 388 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 388 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\SysWOW64\schtasks.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 388 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe

"C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fcaaf8296552e9a4bb23f21e2c88801c3783a163626b44b6cef6e17bbde07bf0.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NNSwwLIbU.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNSwwLIbU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9BC3.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 48.192.11.51.in-addr.arpa udp

Files

memory/388-0-0x000000007484E000-0x000000007484F000-memory.dmp

memory/388-1-0x0000000000440000-0x00000000004FA000-memory.dmp

memory/388-2-0x0000000005450000-0x00000000059F4000-memory.dmp

memory/388-3-0x0000000004F40000-0x0000000004FD2000-memory.dmp

memory/388-4-0x0000000004F00000-0x0000000004F0A000-memory.dmp

memory/388-5-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/388-6-0x00000000051F0000-0x0000000005212000-memory.dmp

memory/388-7-0x0000000005370000-0x000000000537C000-memory.dmp

memory/388-8-0x00000000048F0000-0x0000000004900000-memory.dmp

memory/388-9-0x0000000006200000-0x0000000006284000-memory.dmp

memory/388-10-0x000000000AF00000-0x000000000AF9C000-memory.dmp

memory/388-11-0x000000007484E000-0x000000007484F000-memory.dmp

memory/3300-16-0x0000000002960000-0x0000000002996000-memory.dmp

memory/388-17-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3300-18-0x00000000054F0000-0x0000000005B18000-memory.dmp

memory/3300-19-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3300-20-0x0000000074840000-0x0000000074FF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9BC3.tmp

MD5 8bcdc5897ba924f7202f64fa169d8669
SHA1 2884cf0bdbcd6c561fe4588ae3651f80e54122fc
SHA256 c535ff915434338fe54301ea6718270b199df00c260058c679e05ac81453ffba
SHA512 13bb66b299eb894c81886c192d9157637a3a73b3f2afd2782ce8aff9fbf8c2b50671babadde341a528d5d51df9c2d7988c97aef4df1e70cec0d9d64d0b318f49

memory/4492-22-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3300-23-0x00000000054B0000-0x00000000054D2000-memory.dmp

memory/2720-24-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4492-27-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3300-29-0x0000000005CE0000-0x0000000006034000-memory.dmp

memory/3300-26-0x0000000005C70000-0x0000000005CD6000-memory.dmp

memory/3300-25-0x0000000005B90000-0x0000000005BF6000-memory.dmp

memory/4492-30-0x0000000074840000-0x0000000074FF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iirx4zyv.lpn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/388-31-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3300-50-0x0000000006260000-0x000000000627E000-memory.dmp

memory/3300-51-0x00000000062F0000-0x000000000633C000-memory.dmp

memory/3300-54-0x0000000070F10000-0x0000000070F5C000-memory.dmp

memory/3300-53-0x0000000007230000-0x0000000007262000-memory.dmp

memory/3300-64-0x00000000071F0000-0x000000000720E000-memory.dmp

memory/3300-65-0x0000000007470000-0x0000000007513000-memory.dmp

memory/4492-66-0x0000000070F10000-0x0000000070F5C000-memory.dmp

memory/3300-77-0x00000000075A0000-0x00000000075BA000-memory.dmp

memory/3300-76-0x0000000007BF0000-0x000000000826A000-memory.dmp

memory/4492-78-0x00000000075C0000-0x00000000075CA000-memory.dmp

memory/3300-79-0x0000000007820000-0x00000000078B6000-memory.dmp

memory/3300-80-0x00000000077A0000-0x00000000077B1000-memory.dmp

memory/2720-81-0x0000000005EC0000-0x0000000005F10000-memory.dmp

memory/3300-82-0x00000000077D0000-0x00000000077DE000-memory.dmp

memory/4492-83-0x0000000007790000-0x00000000077A4000-memory.dmp

memory/3300-84-0x00000000078E0000-0x00000000078FA000-memory.dmp

memory/3300-85-0x00000000078C0000-0x00000000078C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4492-92-0x0000000074840000-0x0000000074FF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 98fd6625566d064b692d6d6dd11845bc
SHA1 db962f7cd4840678282852fb89e721ca90c99c20
SHA256 8e2a91cb375bde8322970024fffa1b3a28de04c9b6f83e8f276ba39ca56068c6
SHA512 74b1716451e9f41f19ed172d1726e0a424f8307f13d8d541d3cf76b6b5c55d02123db84e03eafcf786959f0476bb5e45c423c7faeff17babdad7a263c7e925a5

memory/3300-91-0x0000000074840000-0x0000000074FF0000-memory.dmp