Malware Analysis Report

2024-09-11 02:46

Sample ID 240529-cf2b3aeh96
Target de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
Tags
neshta execution persistence spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c

Threat Level: Known bad

The file de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware

Neshta

Command and Scripting Interpreter: PowerShell

Modifies system executable filetype association

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-29 02:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 02:01

Reported

2024-05-29 02:04

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2240 set thread context of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2240 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2240 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IPcHJpNbWh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPcHJpNbWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC46.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/2240-0-0x0000000073F5E000-0x0000000073F5F000-memory.dmp

memory/2240-1-0x0000000001120000-0x00000000011D6000-memory.dmp

memory/2240-2-0x0000000073F50000-0x000000007463E000-memory.dmp

memory/2240-3-0x0000000000360000-0x0000000000376000-memory.dmp

memory/2240-4-0x0000000000430000-0x000000000043C000-memory.dmp

memory/2240-5-0x0000000000440000-0x0000000000450000-memory.dmp

memory/2240-6-0x0000000001060000-0x00000000010EE000-memory.dmp

memory/2240-7-0x0000000073F5E000-0x0000000073F5F000-memory.dmp

memory/2240-8-0x0000000073F50000-0x000000007463E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5YVREXG4L18SQ9U68TFI.temp

MD5 8841628611f1c2f5759bbf905c648d0c
SHA1 fcc7ff3ed9965531fadb56f520ae012fd1993ab5
SHA256 d009f0709b1cd719e2c830724bbc7651cc830c86e8b46b1b86af01e1f2229012
SHA512 ebc87528040cf9514d0292e815f59838ae4b65e194662f4c0a6fdb492515d0dd7d2134c3619bc2761b9b4e476c0ad0b295db748e7affde8e905c26b4829d5493

C:\Users\Admin\AppData\Local\Temp\tmpAC46.tmp

MD5 37f5bf9c663365a5cbe15516387fd715
SHA1 49d85db528246165ec910cb7159b4768e8d53712
SHA256 0471c6b585c66910100925418fa018e8809ec9ab3ea55366cbce147b3fd3bc5b
SHA512 20e3354e9e98d8455d7179d224056c27c5aeda2b8c5776023c4f9148c2b97e901f3eb24a5adebf7b6df03ecd56b9850582501370e0ad7ce5edb5fed0c7c2a066

memory/2080-21-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-37-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2080-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-31-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-29-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-25-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-23-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2240-39-0x0000000073F50000-0x000000007463E000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 aa1eccad845b0434140388dd42b974c7
SHA1 f59d544864821bd2029bd6b6028110aa772d83f2
SHA256 c7cbc72351eff4080d607437ae0872af044b9e98dab6f1e2318024990de9fc92
SHA512 bcd4eec5f0ed974b96687e7e2dfce437a26b543df7e8a5216f9be294017558f0a162714c0856d42534d94e41281eabe636f482f6a318f0883df0230e3cb8e046

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

\Users\Admin\AppData\Roaming\IPCHJP~1.EXE

MD5 6a5f0bde63c130e17660592b253bd1f2
SHA1 92a75cf3b3ff4786e7afcfb7b7b6b281d6b21ad5
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
SHA512 0ec226167102da56e88efe2511e68caab1d272e7da6bcbed71913572d030d97c579a63babe653a93b27da85f38be125755bba820bcef70b8284a6caddbaaa444

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 02:01

Reported

2024-05-29 02:04

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1656 set thread context of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI391D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MICROS~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MIA062~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.29\MI9C33~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.29\MICROS~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1656 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 1656 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 1656 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IPcHJpNbWh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPcHJpNbWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF86A.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1656-0-0x000000007459E000-0x000000007459F000-memory.dmp

memory/1656-1-0x00000000008B0000-0x0000000000966000-memory.dmp

memory/1656-2-0x00000000058A0000-0x0000000005E44000-memory.dmp

memory/1656-3-0x0000000005390000-0x0000000005422000-memory.dmp

memory/1656-4-0x0000000005370000-0x000000000537A000-memory.dmp

memory/1656-5-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1656-6-0x00000000056B0000-0x00000000056C6000-memory.dmp

memory/1656-7-0x0000000006560000-0x000000000656C000-memory.dmp

memory/1656-8-0x0000000006570000-0x0000000006580000-memory.dmp

memory/1656-9-0x00000000065E0000-0x000000000666E000-memory.dmp

memory/1656-10-0x0000000008E60000-0x0000000008EFC000-memory.dmp

memory/1656-11-0x000000007459E000-0x000000007459F000-memory.dmp

memory/1656-12-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1676-17-0x0000000005110000-0x0000000005146000-memory.dmp

memory/1676-18-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1676-20-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1676-19-0x0000000005850000-0x0000000005E78000-memory.dmp

memory/1676-21-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/4496-22-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF86A.tmp

MD5 ae2a11a80b084fc9647787520f879af3
SHA1 e441e8abc1d5817fb56eea8f355df7bfa229f655
SHA256 9bc3d94c89c3138ec686a9959a7f3bdbbedfbccd415135bbabb45c05cf4dd5cf
SHA512 e3ebff54f99d6f18cdb4c78ed44fa1135909143ad98713fafe6f80250f7f45cd385c4a1d93d6f6319be06fcf98eab1f12933ef470017cfb11f5553da8e730122

memory/4496-27-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1676-26-0x0000000006080000-0x00000000060E6000-memory.dmp

memory/4496-28-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1676-29-0x00000000060F0000-0x0000000006444000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xlvqkx55.42w.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3136-31-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3136-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1676-25-0x0000000006010000-0x0000000006076000-memory.dmp

memory/1656-52-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1676-24-0x0000000005F70000-0x0000000005F92000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\RegSvcs.exe

MD5 382f6cf1f66c1b18732736880c7eb390
SHA1 e22b8219d7ff4b18c87ff4bc9bb36813eaa20afa
SHA256 6a49ac1f4cb6501d9b839b070c0c6075263b52e0fe4ab08357b206c79a2d4f75
SHA512 1522b41362551a47f5ec0848913de602d902213eb51286fa7a3403c3950d38b17b7c25d6427e34f85a1201fd2cb5d49498f1163c82dbf4be7c468aaba2ef027b

memory/1676-63-0x00000000066C0000-0x00000000066DE000-memory.dmp

memory/1676-64-0x00000000066F0000-0x000000000673C000-memory.dmp

memory/1676-65-0x00000000076C0000-0x00000000076F2000-memory.dmp

memory/1676-76-0x0000000006C70000-0x0000000006C8E000-memory.dmp

memory/1676-66-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

memory/1676-77-0x0000000007700000-0x00000000077A3000-memory.dmp

memory/1676-78-0x0000000008120000-0x000000000879A000-memory.dmp

memory/1676-79-0x00000000077F0000-0x000000000780A000-memory.dmp

memory/1676-81-0x0000000007860000-0x000000000786A000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 bd9300e68a602b400a4a0bd97faf57d6
SHA1 6b3ed822eba2bbaf35339e9c9b8ba1407c643621
SHA256 65e0ab88bf834ffda59fa295ea5692053cdd654508c6ceb51b50fda27a668b1c
SHA512 1b6e773aaed597de7110b945f2bd9de77f6c8c11355787248b657805c5052708bce37cdc7e21e09ce642a998a9521e311738e71d045e4d5b3b7d29c982592b4a

memory/4496-95-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

memory/1676-105-0x0000000007C80000-0x0000000007D16000-memory.dmp

memory/1676-106-0x0000000007C00000-0x0000000007C11000-memory.dmp

memory/1676-120-0x0000000007C30000-0x0000000007C3E000-memory.dmp

memory/1676-125-0x0000000007C40000-0x0000000007C54000-memory.dmp

memory/1676-131-0x0000000007D40000-0x0000000007D5A000-memory.dmp

memory/1676-137-0x0000000007D20000-0x0000000007D28000-memory.dmp

memory/1676-178-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 65bca3c09a35b4f48722db5dea5be428
SHA1 184f30e37334e5f4f2b319c21222b4163ab244d9
SHA256 8326d325bf9c62ae6e759e3210abd8a9f7eb157e0c7f0daf44d8cc0d4020eae4
SHA512 6f5191fadadfdb6124de57c22d9694ac6856cde6b94bcd784b19943ced166dca6a523c356048b1d03b5711f271fe2f019b13fbff8fd1ddf72c0ef23d96875c39

memory/4496-184-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Users\Admin\AppData\Roaming\IPCHJP~1.EXE

MD5 6a5f0bde63c130e17660592b253bd1f2
SHA1 92a75cf3b3ff4786e7afcfb7b7b6b281d6b21ad5
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
SHA512 0ec226167102da56e88efe2511e68caab1d272e7da6bcbed71913572d030d97c579a63babe653a93b27da85f38be125755bba820bcef70b8284a6caddbaaa444