Malware Analysis Report

2024-09-11 02:46

Sample ID 240529-nhg7racg9z
Target de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
Tags
neshta execution persistence spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c

Threat Level: Known bad

The file de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware

Neshta

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Modifies system executable filetype association

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-29 11:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 11:23

Reported

2024-05-29 11:26

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 808 set thread context of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 808 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 808 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 808 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 808 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 808 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 808 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IPcHJpNbWh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPcHJpNbWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB951.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/808-0-0x00000000742AE000-0x00000000742AF000-memory.dmp

memory/808-1-0x0000000000CF0000-0x0000000000DA6000-memory.dmp

memory/808-2-0x00000000742A0000-0x000000007498E000-memory.dmp

memory/808-3-0x0000000000520000-0x0000000000536000-memory.dmp

memory/808-4-0x00000000008E0000-0x00000000008EC000-memory.dmp

memory/808-5-0x00000000008F0000-0x0000000000900000-memory.dmp

memory/808-6-0x0000000004DD0000-0x0000000004E5E000-memory.dmp

memory/808-7-0x00000000742AE000-0x00000000742AF000-memory.dmp

memory/808-8-0x00000000742A0000-0x000000007498E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB951.tmp

MD5 2f638fdfeb80a8f8100383aa42513be9
SHA1 b3c49cbbb2a88a05c538b2f49611fbc22838485e
SHA256 051b003ee7bbbae083cfba3140d87e7ff676bbcbf83535842ac3c35b79e988b2
SHA512 1eaa3a3ae71bf0e024325cae96663afcce3e5d9b945df0d639eda296281eac08cec900e08f3ad278cebcab978c181563ecebfaffc32e64da55971b44d78dcbdb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 a2f417b8a84315fc0be593b11b5e137a
SHA1 cd0bc723a294d6a78d572f2145ca062d80ba81c0
SHA256 da209d21414d64a585c699868f665613ee6f2ea6aa6340a1cd84eb7fb4990f88
SHA512 a2a48e3dcece544a86d2657c1ddb4c36833562726a892d7a251f9d7699f48adcd9ec13b754afeb73128a89471bac466597c9c60e710b1e5d720e19963c869c09

memory/1448-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-35-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-36-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1448-32-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1448-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/808-38-0x00000000742A0000-0x000000007498E000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 aa1eccad845b0434140388dd42b974c7
SHA1 f59d544864821bd2029bd6b6028110aa772d83f2
SHA256 c7cbc72351eff4080d607437ae0872af044b9e98dab6f1e2318024990de9fc92
SHA512 bcd4eec5f0ed974b96687e7e2dfce437a26b543df7e8a5216f9be294017558f0a162714c0856d42534d94e41281eabe636f482f6a318f0883df0230e3cb8e046

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

\Users\Admin\AppData\Roaming\IPCHJP~1.EXE

MD5 6a5f0bde63c130e17660592b253bd1f2
SHA1 92a75cf3b3ff4786e7afcfb7b7b6b281d6b21ad5
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
SHA512 0ec226167102da56e88efe2511e68caab1d272e7da6bcbed71913572d030d97c579a63babe653a93b27da85f38be125755bba820bcef70b8284a6caddbaaa444

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 11:23

Reported

2024-05-29 11:26

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1800 set thread context of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_pwa_launcher.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~3.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\INSTAL~1\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedgewebview2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\cookie_exporter.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\elevation_service.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\notification_click_helper.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\pwahelper.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~4.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~2.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_proxy.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~1.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1800 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1800 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1800 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1800 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1800 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1800 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1800 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 1800 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 1800 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\SysWOW64\schtasks.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1800 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe

"C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IPcHJpNbWh.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPcHJpNbWh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA38E.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
FR 172.217.20.170:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 170.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

memory/1800-0-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

memory/1800-1-0x0000000000710000-0x00000000007C6000-memory.dmp

memory/1800-2-0x0000000005780000-0x0000000005D24000-memory.dmp

memory/1800-3-0x0000000005270000-0x0000000005302000-memory.dmp

memory/1800-4-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/1800-5-0x00000000051D0000-0x00000000051DA000-memory.dmp

memory/1800-6-0x00000000055C0000-0x00000000055D6000-memory.dmp

memory/1800-7-0x0000000005600000-0x000000000560C000-memory.dmp

memory/1800-8-0x0000000005610000-0x0000000005620000-memory.dmp

memory/1800-9-0x0000000006940000-0x00000000069CE000-memory.dmp

memory/1800-10-0x0000000008FD0000-0x000000000906C000-memory.dmp

memory/1800-11-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

memory/1800-12-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-15-0x0000000002690000-0x00000000026C6000-memory.dmp

memory/4004-16-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-17-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-20-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-21-0x0000000005290000-0x00000000058B8000-memory.dmp

memory/3256-22-0x0000000074F30000-0x00000000756E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA38E.tmp

MD5 bbe87c7299da2ced41655b7da69c3cc6
SHA1 0eb816c47c4d8df68322eaffd332f1702e9d5f51
SHA256 2272deefa43cf751c3bd01bdc6e98d7ff88602a30171edf07a400f3866bcb677
SHA512 0e196984419bc81a048edf41e63abc89eeaae09f58671025ee8a957f45efbe527c6b5a892aba97e7fc5a8ccedb51a2d9c89363bef1a7f7ba029b38d0d104d442

memory/3256-24-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/3256-25-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-26-0x0000000005000000-0x0000000005022000-memory.dmp

memory/4144-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4144-29-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4004-30-0x00000000050A0000-0x0000000005106000-memory.dmp

memory/3256-31-0x0000000005000000-0x0000000005066000-memory.dmp

memory/1800-33-0x0000000074F30000-0x00000000756E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\RegSvcs.exe

MD5 382f6cf1f66c1b18732736880c7eb390
SHA1 e22b8219d7ff4b18c87ff4bc9bb36813eaa20afa
SHA256 6a49ac1f4cb6501d9b839b070c0c6075263b52e0fe4ab08357b206c79a2d4f75
SHA512 1522b41362551a47f5ec0848913de602d902213eb51286fa7a3403c3950d38b17b7c25d6427e34f85a1201fd2cb5d49498f1163c82dbf4be7c468aaba2ef027b

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jo2r2jfg.oso.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3256-63-0x0000000005AD0000-0x0000000005E24000-memory.dmp

memory/4004-64-0x0000000004D80000-0x0000000004D9E000-memory.dmp

memory/3256-65-0x0000000006060000-0x00000000060AC000-memory.dmp

memory/3256-66-0x00000000065D0000-0x0000000006602000-memory.dmp

memory/3256-67-0x0000000070F10000-0x0000000070F5C000-memory.dmp

memory/3256-77-0x00000000065B0000-0x00000000065CE000-memory.dmp

memory/4004-78-0x0000000070F10000-0x0000000070F5C000-memory.dmp

memory/3256-88-0x00000000071E0000-0x0000000007283000-memory.dmp

memory/4004-89-0x00000000079D0000-0x000000000804A000-memory.dmp

memory/4004-90-0x0000000007390000-0x00000000073AA000-memory.dmp

memory/3256-91-0x0000000007390000-0x000000000739A000-memory.dmp

memory/4004-92-0x0000000007600000-0x0000000007696000-memory.dmp

memory/4004-93-0x00000000075A0000-0x00000000075B1000-memory.dmp

memory/4004-94-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-96-0x00000000075C0000-0x00000000075CE000-memory.dmp

memory/3256-95-0x0000000007550000-0x000000000755E000-memory.dmp

memory/4004-97-0x00000000075D0000-0x00000000075E4000-memory.dmp

memory/4004-98-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/3256-99-0x0000000007660000-0x000000000767A000-memory.dmp

memory/4004-100-0x00000000076B0000-0x00000000076B8000-memory.dmp

memory/3256-103-0x0000000074F30000-0x00000000756E0000-memory.dmp

memory/4004-104-0x0000000074F30000-0x00000000756E0000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

MD5 11e8729e3c4685c15fe5e62e9dca9d17
SHA1 030c041ad8865bd636c3e4ffb54ade060b2f8027
SHA256 0c6a09c7e6e814f1591026f84de24b11ad45babb34efdf555d238d964d712412
SHA512 f813a173691fd494c8a22b0957fbd169f2b51256f61edfae92a366e4326a6595ce0d558aebf7c4965e4c67af817ec6e1d2310e96f07cac621fedc75a4e828c31

C:\Users\Admin\AppData\Roaming\IPCHJP~1.EXE

MD5 6a5f0bde63c130e17660592b253bd1f2
SHA1 92a75cf3b3ff4786e7afcfb7b7b6b281d6b21ad5
SHA256 de7f95d2632320ffb7aebc3a0d27378df51315970e19dffe7a361dc4440bf36c
SHA512 0ec226167102da56e88efe2511e68caab1d272e7da6bcbed71913572d030d97c579a63babe653a93b27da85f38be125755bba820bcef70b8284a6caddbaaa444