Malware Analysis Report

2024-11-16 12:12

Sample ID 240723-py4alazglr
Target PL2024-03.exe
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
Tags
neshta execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31

Threat Level: Known bad

The file PL2024-03.exe was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware stealer

Neshta

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Modifies system executable filetype association

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-23 12:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-23 12:45

Reported

2024-07-23 12:49

Platform

win7-20240705-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2772 set thread context of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2772 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2772 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2772 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2772 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

"C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qwyxUYwZbCeXJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwyxUYwZbCeXJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7281.tmp"

C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

"C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

Network

N/A

Files

memory/2772-0-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

memory/2772-1-0x00000000010A0000-0x0000000001164000-memory.dmp

memory/2772-2-0x0000000073F00000-0x00000000745EE000-memory.dmp

memory/2772-3-0x0000000000420000-0x0000000000430000-memory.dmp

memory/2772-4-0x0000000000430000-0x000000000043E000-memory.dmp

memory/2772-5-0x0000000005030000-0x00000000050BE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A3C7D8ICEQGVRSJC784K.temp

MD5 2d12df953b45a1127bc8fd91c131675e
SHA1 40626f4db94d9dbfbcd184ebaf9bdd4c73926641
SHA256 f09897731608098654750572ec413343e0e3218e38f398518b1a131547f33c04
SHA512 cbd0c05978c5e2bb17a4a2143b42234273ab6813834a2a173bfefc6428c2351b4a8b674762bf37f3ce6ee87fa65ec69b99a8999d9717a09a76a41ee70ef92654

C:\Users\Admin\AppData\Local\Temp\tmp7281.tmp

MD5 d26822ac3e53bbb79e7809434dea1a21
SHA1 5ba465f3095515bb40df1f309425c61c7cf09598
SHA256 a5a0170a290dfdca1d3665c3ce426e32f163212e64af65839918d082f5c5e80a
SHA512 32eeea88ba59c6d3190e6db4891ac876a77a7a8fed380da5dd909236985d2a7f09dc957f5c0b686eb3573ec90ba39e85cf0a696ea55caf160cb8b89d20b5395f

memory/2828-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2828-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2828-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2828-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2828-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2772-36-0x0000000073F00000-0x00000000745EE000-memory.dmp

memory/2828-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2828-20-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\svchost.com

MD5 a84134e51db793d68b3b1a8718eb3b32
SHA1 0ff8ae348f19210799b74168610771d019e6ac26
SHA256 88a5de78b70d1164451d38d1415bbba1e374ffca345c089701e6a750212960f6
SHA512 49bb49e190f435708fb2cc8461eace217d883a202a157f812b4277afb582a47db9944abaf7313d909958bfa0b40ee57fbacb844327eeab46ba0b5b4d37b15ec8

memory/2828-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2828-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2828-18-0x0000000000400000-0x000000000041B000-memory.dmp

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Users\Admin\AppData\Roaming\QWYXUY~1.EXE

MD5 31c87737ea27257492b80ffe38db4a02
SHA1 202620c58aee7e3d873f344196fa43c5ad863baf
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
SHA512 f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-23 12:45

Reported

2024-07-23 12:49

Platform

win10v2004-20240709-en

Max time kernel

138s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2248 set thread context of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2248 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2248 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Windows\SysWOW64\schtasks.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe
PID 2248 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

"C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qwyxUYwZbCeXJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwyxUYwZbCeXJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B9A.tmp"

C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe

"C:\Users\Admin\AppData\Local\Temp\PL2024-03.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 43.147.200.23.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/2248-0-0x000000007472E000-0x000000007472F000-memory.dmp

memory/2248-1-0x0000000000BF0000-0x0000000000CB4000-memory.dmp

memory/2248-2-0x0000000005C80000-0x0000000006224000-memory.dmp

memory/2248-3-0x00000000056D0000-0x0000000005762000-memory.dmp

memory/2248-4-0x0000000005870000-0x000000000587A000-memory.dmp

memory/2248-5-0x00000000059D0000-0x0000000005A6C000-memory.dmp

memory/2248-6-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/2248-7-0x00000000059A0000-0x00000000059B0000-memory.dmp

memory/2248-8-0x00000000059C0000-0x00000000059CE000-memory.dmp

memory/2248-9-0x0000000006AF0000-0x0000000006B7E000-memory.dmp

memory/2852-14-0x00000000027A0000-0x00000000027D6000-memory.dmp

memory/2852-15-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/1624-17-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/2852-16-0x0000000005430000-0x0000000005A58000-memory.dmp

memory/1624-18-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/1624-19-0x0000000074720000-0x0000000074ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4B9A.tmp

MD5 ae621f20747b0b3451cb99551ef62e33
SHA1 4c571f844e884e8a2fc6164f8fd7b0a8ceed03dd
SHA256 a1fd8b20fa826b28ba32a43d2f29dfbb113597f56fd6c3884102c78234c7dbc4
SHA512 76122e10e4ca87d62e54f08a9578f75f1652bc3ba0da813703f0be47971e7b30a8ab73fd347db4b72a9048db250ee2febb49093e66ba73c2a163a7e6096abe78

memory/2248-20-0x000000007472E000-0x000000007472F000-memory.dmp

memory/3792-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3792-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1624-31-0x0000000005EE0000-0x0000000006234000-memory.dmp

memory/3792-33-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rv3mh4wh.0xy.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2248-32-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/3792-29-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2248-44-0x0000000074720000-0x0000000074ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\PL2024-03.exe

MD5 eab1cbc9e7da6d32d557dfc901918f72
SHA1 c8c710ccda27bbf5f82b36aa387c1c8a9f14b5d2
SHA256 9343e70417d6d5d6db49c9fa263337c953183ec07f3ee524a43e6d3976cf5dd3
SHA512 aca29afd5a5fb66aa9d4facd5d4bd6fe5b20ae2ac6987fc998ae28407cb6f2983071a1ba0d831baaa72c5a0df0a319065bd08f6c71e3baa993f183f5edd9ceb2

C:\Windows\svchost.com

MD5 a84134e51db793d68b3b1a8718eb3b32
SHA1 0ff8ae348f19210799b74168610771d019e6ac26
SHA256 88a5de78b70d1164451d38d1415bbba1e374ffca345c089701e6a750212960f6
SHA512 49bb49e190f435708fb2cc8461eace217d883a202a157f812b4277afb582a47db9944abaf7313d909958bfa0b40ee57fbacb844327eeab46ba0b5b4d37b15ec8

memory/2852-26-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/1624-25-0x0000000005E70000-0x0000000005ED6000-memory.dmp

memory/1624-24-0x0000000005C10000-0x0000000005C76000-memory.dmp

memory/1624-23-0x0000000005520000-0x0000000005542000-memory.dmp

memory/1624-65-0x0000000006510000-0x000000000655C000-memory.dmp

memory/1624-64-0x00000000064E0000-0x00000000064FE000-memory.dmp

memory/2852-22-0x0000000074720000-0x0000000074ED0000-memory.dmp

memory/1624-67-0x00000000709E0000-0x0000000070A2C000-memory.dmp

memory/1624-77-0x0000000006AA0000-0x0000000006ABE000-memory.dmp

memory/1624-66-0x00000000074C0000-0x00000000074F2000-memory.dmp

memory/1624-78-0x0000000007500000-0x00000000075A3000-memory.dmp

memory/1624-80-0x0000000007800000-0x000000000781A000-memory.dmp

memory/1624-79-0x0000000007E50000-0x00000000084CA000-memory.dmp

memory/1624-81-0x0000000007880000-0x000000000788A000-memory.dmp

memory/2852-83-0x00000000709E0000-0x0000000070A2C000-memory.dmp

memory/1624-82-0x0000000007A80000-0x0000000007B16000-memory.dmp

memory/1624-94-0x0000000007A00000-0x0000000007A11000-memory.dmp

memory/1624-108-0x0000000007A30000-0x0000000007A3E000-memory.dmp

memory/1624-109-0x0000000007A40000-0x0000000007A54000-memory.dmp

memory/1624-110-0x0000000007B40000-0x0000000007B5A000-memory.dmp

memory/1624-112-0x0000000007B20000-0x0000000007B28000-memory.dmp

memory/1624-159-0x0000000074720000-0x0000000074ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2b7e2ae36f8ea8a708ab57a43c089357
SHA1 6f6a13e9e67aaa12489d2e38925d04a3641cffff
SHA256 e9894903437415aaab7b6dd5683a46bc3923948ba72b201bcd6593f1d7acb895
SHA512 7e039ba44a947b64ded46e6f257c0f45a4d8539e444ec6758aefc1497411189937f846fc7b6f694a9e69b0e254570324af37e5a1fec6b99a76a4890adc6e59c4

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/2852-165-0x0000000074720000-0x0000000074ED0000-memory.dmp

C:\Users\Admin\AppData\Roaming\QWYXUY~1.EXE

MD5 31c87737ea27257492b80ffe38db4a02
SHA1 202620c58aee7e3d873f344196fa43c5ad863baf
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
SHA512 f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9

memory/3792-191-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3792-193-0x0000000000400000-0x000000000041B000-memory.dmp