Malware Analysis Report

2024-11-16 12:11

Sample ID 240718-b65xhasgjg
Target 52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a
SHA256 52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a
Tags
neshta execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a

Threat Level: Known bad

The file 52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware stealer

Neshta

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Modifies system executable filetype association

Loads dropped DLL

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-18 01:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-18 01:46

Reported

2024-07-18 01:48

Platform

win7-20240704-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 3032 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 3032 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 3032 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 3032 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2892 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 3032 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cKwHov.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cKwHov" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1017.tmp"

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

Network

N/A

Files

memory/3032-0-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

memory/3032-1-0x0000000000210000-0x00000000002D8000-memory.dmp

memory/3032-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp

memory/3032-3-0x00000000003C0000-0x00000000003DA000-memory.dmp

memory/3032-4-0x00000000003E0000-0x00000000003EE000-memory.dmp

memory/3032-5-0x0000000004E20000-0x0000000004EAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1017.tmp

MD5 f5d31d46865947286e97f1b298b1541e
SHA1 09ff1985ee414d3d8eb71769edbdc50a0f2c1c11
SHA256 aad1445001126ab1f282d2d9569f9b09bfb06c49dd0af339febe4f3900992548
SHA512 05ca050c6465bdd86e67a4069ecfa3c964633ec60239bda1bc57a21a28df5e42226e49db4841e5431cde49dec5ef5f813097d5e3da6909774afe20ae10a46c1f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 fc804b5237a731ee3bcccfdc3f44ebea
SHA1 1f4051e9e32d20efe70103d5e2a0162a762c6ab5
SHA256 f3506e0e70974d54022ab69ac30201c2d8c3317b4e19b96fadfe698d30d953ae
SHA512 4dad4d31bb98f023f62a053b4570cf8bd6508def1f67ed748db6e3e2490c12188b76dfc9a9057353eb613b6560db2dde7d478503a0133b10ea3395cc1980ba51

memory/2948-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-18-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2948-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3032-36-0x0000000073EE0000-0x00000000745CE000-memory.dmp

C:\Windows\svchost.com

MD5 5330e57d83ebfd2e23eed3edcdf305c2
SHA1 cefa86f5d9142358169cb6b38e0c778b816b89de
SHA256 ed75056c3a2cc5ee30b82e834434d2142571bd9f33d934542c74d806921b06e1
SHA512 cd67a12b53fcec69b7efb92f83f9efb2ef9466d40f4321dc853d8457cdadefd4608f07985dc190f60ea753f7f6bb2cc10228bb8b3052af380d92fe7c89d7710e

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Users\Admin\AppData\Roaming\cKwHov.exe

MD5 8dfad0e3e696bc05dbd04eec0f05a3ee
SHA1 48efc77129244380fec520d9f0d81295ccb73020
SHA256 52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a
SHA512 c0072afb7e14708f69dd56f6d4913a0e5b39d2f1f72acdd0b98a179f88ebdf87c43bcad8bd9da7b47cc3c67a938a8fe6ddd2042a0339802c117208094ad69185

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-18 01:46

Reported

2024-07-18 01:48

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 552 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 552 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 552 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 552 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 552 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 552 wrote to memory of 4304 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 552 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Windows\SysWOW64\schtasks.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe
PID 552 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cKwHov.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cKwHov" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF6E3.tmp"

C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

"C:\Users\Admin\AppData\Local\Temp\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp

Files

memory/552-0-0x000000007505E000-0x000000007505F000-memory.dmp

memory/552-1-0x0000000000950000-0x0000000000A18000-memory.dmp

memory/552-2-0x0000000005990000-0x0000000005F34000-memory.dmp

memory/552-3-0x0000000005480000-0x0000000005512000-memory.dmp

memory/552-4-0x0000000005420000-0x000000000542A000-memory.dmp

memory/552-5-0x0000000075050000-0x0000000075800000-memory.dmp

memory/552-6-0x0000000005820000-0x000000000583A000-memory.dmp

memory/552-7-0x0000000005860000-0x000000000586E000-memory.dmp

memory/552-8-0x0000000006680000-0x000000000670E000-memory.dmp

memory/552-9-0x0000000006900000-0x000000000699C000-memory.dmp

memory/2056-14-0x0000000002830000-0x0000000002866000-memory.dmp

memory/2056-15-0x0000000005360000-0x0000000005988000-memory.dmp

memory/2056-16-0x0000000075050000-0x0000000075800000-memory.dmp

memory/2056-17-0x0000000075050000-0x0000000075800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF6E3.tmp

MD5 2467a602818d054b34dc15c594d7f4a0
SHA1 ba3735be134473cfc1d5ed02bb61331b22adb897
SHA256 5f83162e7c9b7aed5c8888d28e7163f35b49b23715ae0632ae8cda9c38f7ffad
SHA512 3028960dd2296331567e591ea07cf0fb8ff8b2d3d69750a9e04e900e6ce83d7408ab656fc51a9283243711e6b596604a414e0cd79ad16794dbb5113d84d0696e

memory/2056-18-0x0000000075050000-0x0000000075800000-memory.dmp

memory/4304-20-0x0000000075050000-0x0000000075800000-memory.dmp

memory/4304-26-0x00000000052A0000-0x00000000052C2000-memory.dmp

memory/4304-42-0x0000000075050000-0x0000000075800000-memory.dmp

memory/4304-33-0x0000000005B90000-0x0000000005BF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zz1zo5vp.1vt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4304-37-0x0000000005C70000-0x0000000005CD6000-memory.dmp

memory/1516-44-0x0000000000400000-0x000000000041B000-memory.dmp

memory/552-46-0x000000007505E000-0x000000007505F000-memory.dmp

memory/4304-48-0x0000000075050000-0x0000000075800000-memory.dmp

memory/2056-45-0x0000000005C80000-0x0000000005FD4000-memory.dmp

memory/1516-43-0x0000000000400000-0x000000000041B000-memory.dmp

memory/552-50-0x0000000075050000-0x0000000075800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a.exe

MD5 8ff4cc260e1da84748eeff749ac3b068
SHA1 28d6ad4832f89d17173544d0be5e747d04ba68ad
SHA256 d44e65167056e565ea37bbb72976e42d4e536e65934fb52839337270daa402ce
SHA512 f3e927fdd6d9236d56d0dec42792e1a7fb84816aeaf3514aa962f68bbb66d6d8f5dd46c4fdb130d48a05aa86c305f0c39d29dcdda0f3410125956f351e27c6f9

C:\Windows\svchost.com

MD5 5330e57d83ebfd2e23eed3edcdf305c2
SHA1 cefa86f5d9142358169cb6b38e0c778b816b89de
SHA256 ed75056c3a2cc5ee30b82e834434d2142571bd9f33d934542c74d806921b06e1
SHA512 cd67a12b53fcec69b7efb92f83f9efb2ef9466d40f4321dc853d8457cdadefd4608f07985dc190f60ea753f7f6bb2cc10228bb8b3052af380d92fe7c89d7710e

memory/2056-61-0x0000000006130000-0x000000000614E000-memory.dmp

memory/2056-62-0x00000000061E0000-0x000000000622C000-memory.dmp

memory/2056-63-0x00000000066F0000-0x0000000006722000-memory.dmp

memory/2056-64-0x00000000715B0000-0x00000000715FC000-memory.dmp

memory/2056-74-0x0000000007130000-0x000000000714E000-memory.dmp

memory/2056-75-0x0000000007150000-0x00000000071F3000-memory.dmp

memory/2056-76-0x0000000007AC0000-0x000000000813A000-memory.dmp

memory/2056-77-0x0000000007480000-0x000000000749A000-memory.dmp

memory/2056-92-0x00000000074F0000-0x00000000074FA000-memory.dmp

memory/4304-93-0x00000000715B0000-0x00000000715FC000-memory.dmp

memory/2056-103-0x0000000007700000-0x0000000007796000-memory.dmp

memory/2056-104-0x0000000007680000-0x0000000007691000-memory.dmp

memory/2056-143-0x00000000076B0000-0x00000000076BE000-memory.dmp

memory/2056-150-0x00000000076C0000-0x00000000076D4000-memory.dmp

memory/2056-151-0x00000000077C0000-0x00000000077DA000-memory.dmp

memory/2056-153-0x00000000077A0000-0x00000000077A8000-memory.dmp

C:\Users\Admin\AppData\Roaming\cKwHov.exe

MD5 8dfad0e3e696bc05dbd04eec0f05a3ee
SHA1 48efc77129244380fec520d9f0d81295ccb73020
SHA256 52da159deec954479ec2bf0b0d48be2f2ee82f029e46c09f7d2747a54b1ecc7a
SHA512 c0072afb7e14708f69dd56f6d4913a0e5b39d2f1f72acdd0b98a179f88ebdf87c43bcad8bd9da7b47cc3c67a938a8fe6ddd2042a0339802c117208094ad69185

memory/2056-182-0x0000000075050000-0x0000000075800000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4fb96fb26a045172a9449133eae3d22a
SHA1 bc6cdb8f78412f853adbf9e820af4c609a72e6b8
SHA256 426be2db37e111dc3306bcabee776a755bfee6d592a04252dbfcd65205677977
SHA512 bcf528d9b71eb107d2d143f8c5d9d2db91694570acac1ff9a412d648aad398a870a39c23e6d740d5d3fb1a1c16fbc96b96764c971ded14d277f90c42dc1c669e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4304-186-0x0000000075050000-0x0000000075800000-memory.dmp