Malware Analysis Report

2024-09-11 02:46

Sample ID 240531-zycgzsec34
Target Inquiry UMARH23680-3.exe
SHA256 d2fe22f934f6a5445d64e90c88d01a21793f80b0756d520e2d5744cd081193e1
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d2fe22f934f6a5445d64e90c88d01a21793f80b0756d520e2d5744cd081193e1

Threat Level: Known bad

The file Inquiry UMARH23680-3.exe was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Detect Neshta payload

Neshta

Reads user/profile data of web browsers

Modifies system executable filetype association

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Privilege Escalation
TA0004
Event Triggered Execution
T1546
Change Default File Association
T1546.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-31 21:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 21:07

Reported

2024-05-31 21:09

Platform

win7-20240221-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2844 set thread context of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2844 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

Network

N/A

Files

memory/2844-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

memory/2844-1-0x0000000000810000-0x00000000008CC000-memory.dmp

memory/2844-2-0x0000000074BA0000-0x000000007528E000-memory.dmp

memory/2844-3-0x00000000007F0000-0x0000000000808000-memory.dmp

memory/2844-4-0x00000000005D0000-0x00000000005E0000-memory.dmp

memory/2844-5-0x0000000005CE0000-0x0000000005D6C000-memory.dmp

memory/2528-6-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-16-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2528-18-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-14-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-12-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-10-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-8-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-23-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2528-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2844-31-0x0000000074BA0000-0x000000007528E000-memory.dmp

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 e94ae69428588ddf92315a7453218615
SHA1 a3e6a4e084d05921cd23aeb8042fef21f8526152
SHA256 496b76e12794b8b7adc133b0bd78f641570a11fc563091ff744db1fa1076c485
SHA512 b29aa1e21c7ca5fbe1ca10966e2325752d899f32c56466c1a6a613c7a88b5d0abeca95b640a8f17b2487a8ae4acb877101b3543582df976556c9fa11470fd9bb

memory/2528-100-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 21:07

Reported

2024-05-31 21:09

Platform

win10v2004-20240508-en

Max time kernel

135s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2040 set thread context of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_proxy.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\identity_helper.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\BHO\ie_to_edge_stub.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\pwahelper.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedgewebview2.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_click_helper.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe
PID 2040 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4488,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe

"C:\Users\Admin\AppData\Local\Temp\Inquiry UMARH23680-3.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/2040-0-0x000000007507E000-0x000000007507F000-memory.dmp

memory/2040-1-0x00000000001D0000-0x000000000028C000-memory.dmp

memory/2040-2-0x0000000005120000-0x00000000056C4000-memory.dmp

memory/2040-3-0x0000000004B70000-0x0000000004C02000-memory.dmp

memory/2040-4-0x0000000004AF0000-0x0000000004AFA000-memory.dmp

memory/2040-5-0x0000000075070000-0x0000000075820000-memory.dmp

memory/2040-6-0x0000000004E50000-0x0000000004E68000-memory.dmp

memory/2040-7-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/2040-8-0x00000000060C0000-0x000000000614C000-memory.dmp

memory/2040-9-0x0000000009C80000-0x0000000009D1C000-memory.dmp

memory/4836-10-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4836-11-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4836-13-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4836-15-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2040-16-0x0000000075070000-0x0000000075820000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\Inquiry UMARH23680-3.exe

MD5 f957675b0f5aa6b8faa54344f88ba0a2
SHA1 b6070a0471673d5acdd631817c90f901a37128c5
SHA256 a26b9e958d6af8c8f3c766848a16430fb0cedef06ba6df941246956e28c17073
SHA512 6ca4d41a8dee6c8f5d3e04e1228e8b96fa0417becf485b732196d9df09ad8374fa2e9aa4726bd052ecbcfd9e1377cad0b2c98238a09405a046c5aa78cf4dbb73

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 c572b0d3a19f7ee5283d76fa6d9ff6f3
SHA1 ca01f2e49399b230f3c791251eb4f34c26e98cf0
SHA256 670cfdb2b57d9c8ed0fb80df6b10ad25896666cc34497c156d86a0377113555f
SHA512 d5d32f1b751655f2a8a82d821ec7cb83428c87b0987ab44fbc8d45b79f151ca5a0eb5ed8d85af3ce54b15e14b50d981ef4f91735465ca2906f06230b23d8deed

memory/4836-121-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4836-123-0x0000000000400000-0x000000000041B000-memory.dmp