neshta | 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
Size 756KB
Sample240724-blhapszapp
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
MD5 31c87737ea27257492b80ffe38db4a02
SHA1 202620c58aee7e3d873f344196fa43c5ad863baf
SHA512 f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9
SSDEEP 12288:PfyfpWOhx8kPn3HLK1ADGl8qWp5YXaZG5EpKXoz9E6IgybM6LIrGH0Tl2TAXjUva:PfyjiGuASGqM5YXH5U9bITbj8LTUTijU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta discovery execution persistence spyware stealer

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3016	powershell.exe
3500	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI9C33~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
3016	powershell.exe
3500	powershell.exe
3500	powershell.exe
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
3016	powershell.exe
3016	powershell.exe
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
3500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3016	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	94
PID 5068 wrote to memory of 3016	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	94
PID 5068 wrote to memory of 3016	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	94
PID 5068 wrote to memory of 3500	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	96
PID 5068 wrote to memory of 3500	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	96
PID 5068 wrote to memory of 3500	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	96
PID 5068 wrote to memory of 4356	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	98
PID 5068 wrote to memory of 4356	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	98
PID 5068 wrote to memory of 4356	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	98
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100
PID 5068 wrote to memory of 2056	5068	16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe	100

C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qwyxUYwZbCeXJ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwyxUYwZbCeXJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
  "C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"
  2⤵
  - Checks computer location settings
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 2d7e7ab04a8d4005c922fa7d496fc00d7c8f743e427c63cee35d64c0c01bed0d
MD5 c4965c22c155790548b3be9584260a48
SHA1 cb414ac051b5ab540e6e04ea4f65cfa9e40bf491
SHA512 b2d38d61b1af634812406a892b68435b882e50c19bce1e94995fa75baceb4237cdebc0223ce86fc3dddf087649f5bdc8736ea1b48430f87cb1e7b0e6e3110dfd
SSDEEP 384:V6+BO9i+0pyIOZ8UizJk+o9o2ThK6seYLME/N03SoZSfYSvcjEDkyd0gdEtkKhD:08kz8jejo2ThNgrWSl5CEDOCe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
Size 716KB
SHA256 9343e70417d6d5d6db49c9fa263337c953183ec07f3ee524a43e6d3976cf5dd3
MD5 eab1cbc9e7da6d32d557dfc901918f72
SHA1 c8c710ccda27bbf5f82b36aa387c1c8a9f14b5d2
SHA512 aca29afd5a5fb66aa9d4facd5d4bd6fe5b20ae2ac6987fc998ae28407cb6f2983071a1ba0d831baaa72c5a0df0a319065bd08f6c71e3baa993f183f5edd9ceb2
SSDEEP 12288:gayyfpWOhx8kPn3HLK1ADGl8qWp5YXaZG5EpKXoz9E6IgybM6LIrGH0Tl2TAXjU/:QyjiGuASGqM5YXH5U9bITbj8LTUTijU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0j0ybage.3iw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0j0ybage.3iw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpD8BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp
Size 1KB
SHA256 d11f094ec510083ac5f1de11862aeabfbef788a9f5ee2959c50145c8a0e6ec5a
MD5 1ccf6ee093d7156b589314139bd9e87a
SHA1 6baabb904264e1e1fe8b096b2133b4b97645892a
SHA512 611e05d056e3cdb61bbfd7a703d0d9a8dd849a06d8bc6dcccbb438f0346d3e6656ab6d7a91df89a1cda82eedf1a02c12527c3a0d0ae2882725ffe2b570f60e23
MD5 SHA1 SHA512

Submit Download

QWYXUY~1.EXE

Path C:\Users\Admin\AppData\Roaming\QWYXUY~1.EXE
Size 756KB
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
MD5 31c87737ea27257492b80ffe38db4a02
SHA1 202620c58aee7e3d873f344196fa43c5ad863baf
SHA512 f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9
SSDEEP 12288:PfyfpWOhx8kPn3HLK1ADGl8qWp5YXaZG5EpKXoz9E6IgybM6LIrGH0Tl2TAXjUva:PfyjiGuASGqM5YXH5U9bITbj8LTUTijU
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 88a5de78b70d1164451d38d1415bbba1e374ffca345c089701e6a750212960f6
MD5 a84134e51db793d68b3b1a8718eb3b32
SHA1 0ff8ae348f19210799b74168610771d019e6ac26
SHA512 49bb49e190f435708fb2cc8461eace217d883a202a157f812b4277afb582a47db9944abaf7313d909958bfa0b40ee57fbacb844327eeab46ba0b5b4d37b15ec8
SSDEEP 768:zNiwLaklnN5+JwfIiXnfjqZFKsgn7aqNF:xiU5N5+sfjQFKsgn7aqNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2056-46-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2056-47-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3016-90-0x0000000007790000-0x0000000007E0A000-memory.dmp

Download

memory/3016-103-0x00000000073D0000-0x0000000007466000-memory.dmp

Download

memory/3016-16-0x0000000004FE0000-0x0000000005608000-memory.dmp

Download

memory/3016-17-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/3016-15-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/3016-182-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/3016-19-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/3016-162-0x0000000007470000-0x0000000007478000-memory.dmp

Download

memory/3016-28-0x0000000005700000-0x0000000005766000-memory.dmp

Download

memory/3016-27-0x0000000004F00000-0x0000000004F66000-memory.dmp

Download

memory/3016-155-0x0000000007490000-0x00000000074AA000-memory.dmp

Download

memory/3016-152-0x0000000007390000-0x00000000073A4000-memory.dmp

Download

memory/3016-20-0x0000000004E60000-0x0000000004E82000-memory.dmp

Download

memory/3016-34-0x0000000005970000-0x0000000005CC4000-memory.dmp

Download

memory/3016-151-0x0000000007380000-0x000000000738E000-memory.dmp

Download

memory/3016-106-0x0000000007350000-0x0000000007361000-memory.dmp

Download

memory/3016-14-0x0000000002510000-0x0000000002546000-memory.dmp

Download

memory/3016-102-0x00000000071C0000-0x00000000071CA000-memory.dmp

Download

memory/3016-91-0x0000000007150000-0x000000000716A000-memory.dmp

Download

memory/3016-75-0x0000000006FF0000-0x0000000007093000-memory.dmp

Download

memory/3016-64-0x00000000752F0000-0x000000007533C000-memory.dmp

Download

memory/3016-59-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Download

memory/3016-62-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

Download

memory/3016-63-0x0000000006400000-0x0000000006432000-memory.dmp

Download

memory/3016-74-0x00000000063E0000-0x00000000063FE000-memory.dmp

Download

memory/3500-92-0x00000000752F0000-0x000000007533C000-memory.dmp

Download

memory/3500-186-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/3500-21-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/3500-36-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/5068-35-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/5068-6-0x0000000005C40000-0x0000000005CDC000-memory.dmp

Download

memory/5068-7-0x0000000008650000-0x0000000008660000-memory.dmp

Download

memory/5068-5-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download

memory/5068-4-0x00000000059D0000-0x00000000059DA000-memory.dmp

Download

memory/5068-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Download

memory/5068-8-0x0000000006BC0000-0x0000000006BCE000-memory.dmp

Download

memory/5068-9-0x0000000006C00000-0x0000000006C8E000-memory.dmp

Download

memory/5068-3-0x0000000005A00000-0x0000000005A92000-memory.dmp

Download

memory/5068-18-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Download

memory/5068-2-0x0000000005F10000-0x00000000064B4000-memory.dmp

Download

memory/5068-1-0x0000000000ED0000-0x0000000000F94000-memory.dmp

Download

memory/5068-56-0x0000000074A40000-0x00000000751F0000-memory.dmp

Download