Malware Analysis Report

2024-09-11 03:26

Sample ID 240528-nwp5hsag66
Target SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
Tags
neshta execution persistence spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c

Threat Level: Known bad

The file SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware

Neshta

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Modifies system executable filetype association

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-28 11:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-28 11:45

Reported

2024-05-28 11:47

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1944 set thread context of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1944 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1944 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IPcHJpNbWh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPcHJpNbWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6E7.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/1944-0-0x00000000748DE000-0x00000000748DF000-memory.dmp

memory/1944-1-0x00000000013C0000-0x0000000001476000-memory.dmp

memory/1944-2-0x00000000748D0000-0x0000000074FBE000-memory.dmp

memory/1944-3-0x00000000007A0000-0x00000000007B6000-memory.dmp

memory/1944-4-0x00000000007F0000-0x00000000007FC000-memory.dmp

memory/1944-5-0x00000000009E0000-0x00000000009F0000-memory.dmp

memory/1944-6-0x0000000004F80000-0x000000000500E000-memory.dmp

memory/1944-7-0x00000000748DE000-0x00000000748DF000-memory.dmp

memory/1944-8-0x00000000748D0000-0x0000000074FBE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 fd42306d398a981ef061a1556bc0bf98
SHA1 2c83f79c4ac31b35592dbb7f6a171bfce3777432
SHA256 9ba941bc29b9c2de32eadef15955ee6c035eda61b4d902795f63ba7a40dca85c
SHA512 14b5a1307506fa3401d288457922c4345dd0bed46d23f2424934ec60c7271a11b6467e02745c6d7a3de4ccfff65c5385770213f1ed7d4876ce12096bfdbce6c0

C:\Users\Admin\AppData\Local\Temp\tmpC6E7.tmp

MD5 494c473caafa949f2516d727a0afbc37
SHA1 60ceea2bc28d746ec78610d9b1b8fab835d77ce2
SHA256 bc56e42a5825b4a043535bfcf191f257c02e9220db273cfb90efd54dbef89807
SHA512 d1cf198310826d00866e36e7e71ae0d2042e25eec75f6fa0612cfe7a77d4ddf6fa480c667801165b0706ff08d3c26495e5c4707e0a2326704329b684238515ff

memory/2368-21-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2368-37-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-31-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-29-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-25-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2368-23-0x0000000000400000-0x000000000041B000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 aa1eccad845b0434140388dd42b974c7
SHA1 f59d544864821bd2029bd6b6028110aa772d83f2
SHA256 c7cbc72351eff4080d607437ae0872af044b9e98dab6f1e2318024990de9fc92
SHA512 bcd4eec5f0ed974b96687e7e2dfce437a26b543df7e8a5216f9be294017558f0a162714c0856d42534d94e41281eabe636f482f6a318f0883df0230e3cb8e046

memory/1944-47-0x00000000748D0000-0x0000000074FBE000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

\Users\Admin\AppData\Roaming\IPCHJP~1.EXE

MD5 6a5f0bde63c130e17660592b253bd1f2
SHA1 92a75cf3b3ff4786e7afcfb7b7b6b281d6b21ad5
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
SHA512 0ec226167102da56e88efe2511e68caab1d272e7da6bcbed71913572d030d97c579a63babe653a93b27da85f38be125755bba820bcef70b8284a6caddbaaa444

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-28 11:45

Reported

2024-05-28 11:48

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3916 set thread context of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_proxy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\BHO\ie_to_edge_stub.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_click_helper.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~4.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI9C33~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\elevation_service.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\pwahelper.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3916 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3916 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3916 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3916 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3916 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3916 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3916 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 4616 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\SysWOW64\schtasks.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3916 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe

"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1748,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6810.32478.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IPcHJpNbWh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPcHJpNbWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B14.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
BE 88.221.83.192:443 www.bing.com tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 192.83.221.88.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 199.111.78.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/3916-0-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

memory/3916-1-0x0000000000B70000-0x0000000000C26000-memory.dmp

memory/3916-2-0x0000000005CC0000-0x0000000006264000-memory.dmp

memory/3916-3-0x00000000055C0000-0x0000000005652000-memory.dmp

memory/3916-4-0x0000000005690000-0x000000000569A000-memory.dmp

memory/3916-5-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/3916-6-0x0000000005C80000-0x0000000005C96000-memory.dmp

memory/3916-7-0x0000000006770000-0x000000000677C000-memory.dmp

memory/3916-8-0x0000000006780000-0x0000000006790000-memory.dmp

memory/3916-9-0x00000000067F0000-0x000000000687E000-memory.dmp

memory/3916-10-0x0000000006A60000-0x0000000006AFC000-memory.dmp

memory/3916-11-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

memory/3916-12-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/4588-17-0x0000000002670000-0x00000000026A6000-memory.dmp

memory/4588-18-0x0000000005280000-0x00000000058A8000-memory.dmp

memory/4588-19-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/4588-20-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/4336-21-0x0000000074F90000-0x0000000075740000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8B14.tmp

MD5 5c1c9725649738a49efc2e883bfff7b9
SHA1 c39c15fa816156ccbdd1a27f20537f989878dc2b
SHA256 09cc0750dcad8bbae5ad970bcbe8cfa8b813fc91059ef0a31adb38b5e41786a3
SHA512 fb17166fd8cdbd05606153bd3331c6e91cd92ce1c5e807722f2d959f706de638a2e3c9bb6ec302b503127021eb05cd562090e0ff62152b7df20923d2afdcba36

memory/4588-24-0x00000000058B0000-0x0000000005916000-memory.dmp

memory/4588-23-0x0000000005040000-0x00000000050A6000-memory.dmp

memory/4588-26-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/4336-33-0x0000000074F90000-0x0000000075740000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ciznk5yl.pqz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4588-27-0x0000000005920000-0x0000000005C74000-memory.dmp

memory/4588-22-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

memory/4336-47-0x00000000064D0000-0x00000000064EE000-memory.dmp

memory/688-51-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3916-53-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/688-49-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4336-48-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\RegSvcs.exe

MD5 382f6cf1f66c1b18732736880c7eb390
SHA1 e22b8219d7ff4b18c87ff4bc9bb36813eaa20afa
SHA256 6a49ac1f4cb6501d9b839b070c0c6075263b52e0fe4ab08357b206c79a2d4f75
SHA512 1522b41362551a47f5ec0848913de602d902213eb51286fa7a3403c3950d38b17b7c25d6427e34f85a1201fd2cb5d49498f1163c82dbf4be7c468aaba2ef027b

memory/4588-75-0x00000000070D0000-0x00000000070EE000-memory.dmp

memory/4336-76-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/4588-77-0x0000000007140000-0x00000000071E3000-memory.dmp

memory/4588-65-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/4588-64-0x00000000070F0000-0x0000000007122000-memory.dmp

memory/4588-88-0x0000000007290000-0x00000000072AA000-memory.dmp

memory/4588-87-0x00000000078E0000-0x0000000007F5A000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 bd9300e68a602b400a4a0bd97faf57d6
SHA1 6b3ed822eba2bbaf35339e9c9b8ba1407c643621
SHA256 65e0ab88bf834ffda59fa295ea5692053cdd654508c6ceb51b50fda27a668b1c
SHA512 1b6e773aaed597de7110b945f2bd9de77f6c8c11355787248b657805c5052708bce37cdc7e21e09ce642a998a9521e311738e71d045e4d5b3b7d29c982592b4a

memory/4588-103-0x0000000007300000-0x000000000730A000-memory.dmp

memory/4588-104-0x0000000007510000-0x00000000075A6000-memory.dmp

memory/4588-106-0x0000000007490000-0x00000000074A1000-memory.dmp

memory/4588-165-0x00000000074C0000-0x00000000074CE000-memory.dmp

memory/4588-166-0x00000000074D0000-0x00000000074E4000-memory.dmp

memory/4336-167-0x0000000007B50000-0x0000000007B6A000-memory.dmp

memory/4588-173-0x00000000075B0000-0x00000000075B8000-memory.dmp

C:\Users\Admin\AppData\Roaming\IPCHJP~1.EXE

MD5 6a5f0bde63c130e17660592b253bd1f2
SHA1 92a75cf3b3ff4786e7afcfb7b7b6b281d6b21ad5
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
SHA512 0ec226167102da56e88efe2511e68caab1d272e7da6bcbed71913572d030d97c579a63babe653a93b27da85f38be125755bba820bcef70b8284a6caddbaaa444

memory/4588-185-0x0000000074F90000-0x0000000075740000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 451c9c0694a18ae94cb0436613404e2e
SHA1 235f5515532c4a258f9fc1458c7a2ef0f7ab4219
SHA256 fe267842e972d1bff978c626c9ba489f6316f0d7e1e156118a31cd036374cf59
SHA512 03a330b2667098bd7bebca1b2fc4901a4c5c2cd1fad51dfd5aacc7ebe2171402af2d05eb1948d7bdae5b8faa2486dcd01430996b404352c661656aab4a915b85

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4336-200-0x0000000074F90000-0x0000000075740000-memory.dmp