Malware analysis VirusOrg.Neshta.A.exe Malicious activity

Add for printing

File name:	VirusOrg.Neshta.A.exe
Full analysis:	https://app.any.run/tasks/3b157d68-0e1b-46e6-84d4-cf398998809f
Verdict:	Malicious activity
Analysis date:	January 06, 2025, 04:38:32
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	neshta upx evasion
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:	70D5410D4DE51C059D1E6519C0BF7715
SHA1:	43004AEC691EBEC79E90B6686C63A0BB2B461DD6
SHA256:	79DA6C92E80C7B5B5A858CAAC08C21F0CFCD0DDC865E73CC26A2E10FE04C6E42
SSDEEP:	768:1Ao4BhL0vjnyvAcb7zlCrCBEWwT0qCM2YlFCjy:cBFcjni5CrCqlTd/xlg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- NESHTA mutex has been found
  - VirusOrg.Neshta.A.exe (PID: 6180)
- Changes the autorun value in the registry
  - CCleaner64.exe (PID: 6700)
SUSPICIOUS
- Mutex name with non-standard characters
  - VirusOrg.Neshta.A.exe (PID: 6180)
- Reads security settings of Internet Explorer
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Executable content was dropped or overwritten
  - VirusOrg.Neshta.A.exe (PID: 6180)
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Reads the date of Windows installation
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 5244)
- Application launched itself
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 5244)
- Reads Internet Explorer settings
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Checks Windows Trust Settings
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Searches for installed software
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Checks for external IP
  - CCleaner64.exe (PID: 5244)
INFO
- Process checks computer location settings
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 5244)
- UPX packer has been detected
  - VirusOrg.Neshta.A.exe (PID: 6180)
- Reads Environment values
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Checks supported languages
  - CCleaner64.exe (PID: 5244)
  - VirusOrg.Neshta.A.exe (PID: 6180)
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 6700)
- Manual execution by a user
  - Taskmgr.exe (PID: 6984)
  - CCleaner64.exe (PID: 748)
  - Taskmgr.exe (PID: 7040)
- Reads the computer name
  - CCleaner64.exe (PID: 748)
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Reads security settings of Internet Explorer
  - Taskmgr.exe (PID: 7040)
- Drops encrypted VBS script (Microsoft Script Encoder)
  - VirusOrg.Neshta.A.exe (PID: 6180)
- Sends debugging messages
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Reads product name
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Reads CPU info
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Reads the machine GUID from the registry
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- The sample compiled with english language support
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- Reads the software policy settings
  - CCleaner64.exe (PID: 5244)
  - CCleaner64.exe (PID: 6700)
- The process uses the downloaded file
  - CCleaner64.exe (PID: 5244)
- Checks proxy server information
  - CCleaner64.exe (PID: 5244)
- Creates files or folders in the user directory
  - CCleaner64.exe (PID: 5244)
- Creates files in the program directory
  - CCleaner64.exe (PID: 5244)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	UPX compressed Win32 Executable (61.1)
.dll	\|	Win32 Dynamic Link Library (generic) (14.8)
.exe	\|	Win32 Executable (generic) (10.1)
.exe	\|	Win16/32 Executable Delphi generic (4.6)
.exe	\|	Generic Win/DOS Executable (4.5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1992:06:19 22:22:17+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	20480
InitializedDataSize:	8192
UninitializedDataSize:	94208
EntryPoint:	0x1c840
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

748

"C:\Program Files\CCleaner\CCleaner64.exe"

C:\Program Files\CCleaner\CCleaner64.exe

—

explorer.exe

User:

admin

Company:

Piriform Software Ltd

Integrity Level:

MEDIUM

Description:

CCleaner

Exit code:

Version:

6.20.0.10897

Modules

Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

5244

"C:\Program Files\CCleaner\CCleaner64.exe" /uac

C:\Program Files\CCleaner\CCleaner64.exe

CCleaner64.exe

User:

admin

Company:

Piriform Software Ltd

Integrity Level:

HIGH

Description:

CCleaner

Version:

6.20.0.10897

Modules

Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

6180

"C:\Users\admin\AppData\Local\Temp\VirusOrg.Neshta.A.exe"

C:\Users\admin\AppData\Local\Temp\VirusOrg.Neshta.A.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\virusorg.neshta.a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

6688

C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\rundll32.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

6700

"C:\Program Files\CCleaner\CCleaner64.exe" /monitor

C:\Program Files\CCleaner\CCleaner64.exe

CCleaner64.exe

User:

admin

Company:

Piriform Software Ltd

Integrity Level:

HIGH

Description:

CCleaner

Version:

6.20.0.10897

Modules

Images
c:\program files\ccleaner\ccleaner64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

6984

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Task Manager

Exit code:

3221226540

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll

7040

"C:\WINDOWS\system32\taskmgr.exe" /4

C:\Windows\System32\Taskmgr.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Task Manager

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll

Add for printing

Total events

21 231

Read events

21 096

Write events

Delete events

Modification events


(PID) Process:	(7040) Taskmgr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:	delete value	Name:	Preferences
Value:
(PID) Process:	(7040) Taskmgr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:	write	Name:	Preferences
Value: 0D00000060000000600000006800000068000000E3010000DC010000000001000000008000000080D8010080DF010080000100016B00000034000000130300008C020000E80300000000000000000000000000000F000000010000000000000058AA6C15F77F00000000000000000000000000002E0100001E0000008990000000000000FF00000001015002000000000D0000000000000098AA6C15F77F00000000000000000000FFFFFFFF960000001E0000008B900000010000000000000000101001000000000300000000000000B0AA6C15F77F00000000000000000000FFFFFFFF780000001E0000008C900000020000000000000001021200000000000400000000000000C8AA6C15F77F00000000000000000000FFFFFFFF960000001E0000008D900000030000000000000000011001000000000200000000000000E8AA6C15F77F00000000000000000000FFFFFFFF320000001E0000008A90000004000000000000000008200100000000050000000000000000AB6C15F77F00000000000000000000FFFFFFFFC80000001E0000008E90000005000000000000000001100100000000060000000000000028AB6C15F77F00000000000000000000FFFFFFFF040100001E0000008F90000006000000000000000001100100000000070000000000000050AB6C15F77F00000000000000000000FFFFFFFF49000000490000009090000007000000000000000004250000000000080000000000000080AA6C15F77F00000000000000000000FFFFFFFF49000000490000009190000008000000000000000004250000000000090000000000000070AB6C15F77F00000000000000000000FFFFFFFF490000004900000092900000090000000000000000042508000000000A0000000000000088AB6C15F77F00000000000000000000FFFFFFFF4900000049000000939000000A0000000000000000042508000000000B00000000000000A8AB6C15F77F00000000000000000000FFFFFFFF490000004900000039A000000B0000000000000000042509000000001C00000000000000C8AB6C15F77F00000000000000000000FFFFFFFFC8000000490000003AA000000C0000000000000000011009000000001D00000000000000F0AB6C15F77F00000000000000000000FFFFFFFF64000000490000004CA000000D0000000000000000021508000000001E0000000000000010AC6C15F77F00000000000000000000FFFFFFFF64000000490000004DA000000E000000000000000002150800000000030000000A000000010000000000000058AA6C15F77F0000000000000000000000000000D70000001E0000008990000000000000FF00000001015002000000000400000000000000C8AA6C15F77F0000000000000000000001000000960000001E0000008D900000010000000000000001011000000000000300000000000000B0AA6C15F77F00000000000000000000FFFFFFFF640000001E0000008C900000020000000000000000021000000000000C0000000000000040AC6C15F77F0000000000000000000003000000640000001E00000094900000030000000000000001021000000000000D0000000000000068AC6C15F77F00000000000000000000FFFFFFFF640000001E00000095900000040000000000000000011001000000000E0000000000000090AC6C15F77F0000000000000000000005000000320000001E00000096900000050000000000000001042001000000000F00000000000000B8AC6C15F77F0000000000000000000006000000320000001E00000097900000060000000000000001042001000000001000000000000000D8AC6C15F77F0000000000000000000007000000460000001E00000098900000070000000000000001011001000000001100000000000000F8AC6C15F77F00000000000000000000FFFFFFFF640000001E0000009990000008000000000000000001100100000000060000000000000028AB6C15F77F0000000000000000000009000000040100001E0000008F9000000900000000000000010110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000B000000010000000000000058AA6C15F77F0000000000000000000000000000D70000001E0000009E90000000000000FF0000000101500200000000120000000000000020AD6C15F77F00000000000000000000FFFFFFFF2D0000001E0000009B90000001000000000000000004200100000000140000000000000040AD6C15F77F00000000000000000000FFFFFFFF640000001E0000009D90000002000000000000000001100100000000130000000000000068AD6C15F77F00000000000000000000FFFFFFFF640000001E0000009C900000030000000000000000011001000000000300000000000000B0AA6C15F77F00000000000000000000FFFFFFFF640000001E0000008C90000004000000000000000102100000000000070000000000000050AB6C15F77F000000000000000000000500000049000000490000009090000005000000000000000104210000000000080000000000000080AA6C15F77F000000000000000000000600000049000000490000009190000006000000000000000104210000000000090000000000000070AB6C15F77F0000000000000000000007000000490000004900000092900000070000000000000001042108000000000A0000000000000088AB6C15F77F0000000000000000000008000000490000004900000093900000080000000000000001042108000000000B00000000000000A8AB6C15F77F0000000000000000000009000000490000004900000039A00000090000000000000001042109000000001C00000000000000C8AB6C15F77F000000000000000000000A00000064000000490000003AA000000A00000000000000000110090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000008000000010000000000000058AA6C15F77F0000000000000000000000000000C60000001E000000B090000000000000FF0000000101500200000000150000000000000088AD6C15F77F00000000000000000000FFFFFFFF6B0000001E000000B1900000010000000000000000042500000000001600000000000000B8AD6C15F77F00000000000000000000FFFFFFFF6B0000001E000000B2900000020000000000000000042500000000001800000000000000E0AD6C15F77F00000000000000000000FFFFFFFF6B0000001E000000B490000003000000000000000004250000000000170000000000000008AE6C15F77F00000000000000000000FFFFFFFF6B0000001E000000B390000004000000000000000004250000000000190000000000000040AE6C15F77F00000000000000000000FFFFFFFFA00000001E000000B5900000050000000000000000042001000000001A0000000000000070AE6C15F77F00000000000000000000FFFFFFFF7D0000001E000000B6900000060000000000000000042001000000001B00000000000000A0AE6C15F77F00000000000000000000FFFFFFFF7D0000001E000000B790000007000000000000000004200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA00000000000000000000000000000000000000000000009D200000200000009100000064000000320000006400000050000000320000003200000028000000500000003C0000005000000050000000320000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C00000050000000500000009700000032000000780000003200000050000000500000005000000050000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA000000000000000000000000000000000000009D200000200000009100000064000000320000009700000050000000320000003200000028000000500000003C000000500000005000000032000000500000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C0000005000000064000000780000003200000078000000780000003200000050000000500000005000000050000000C8000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C0000002D0000002E0000002F00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	DAST
Value: 01/06/2025 04:39:21
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	T8062
Value: 0
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	UpdateBackground
Value: 1
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	write	Name:	NumOfOutdatedDrivers
Value: 0
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	delete value	Name:	GUID
Value:
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	delete value	Name:	GD
Value:
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Piriform\CCleaner
Operation:	delete value	Name:	SetupGD
Value:
(PID) Process:	(5244) CCleaner64.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:	write	Name:	SystemRestorePointCreationFrequency
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6180	VirusOrg.Neshta.A.exe	C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe		executable
		MD5:26CC9A5C2A22D88C26670CD36D405535	SHA256:3B9F03C3AD2345DF6CDD7DBEC60B75E12B9D3F65D08C6FA6F760809BBD1BA412
5244	CCleaner64.exe	C:\Program Files\CCleaner\gcapi_17361383615244.dll		executable
		MD5:F17F96322F8741FE86699963A1812897	SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
5244	CCleaner64.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M82C9XI0J78CHHQ4XPPX.temp		binary
		MD5:B9907D8822B31ACBB3CCB574C48BA607	SHA256:987155D21631E392AE1921ABF3F32926A01A81C4B4195267FEA7FA228E4C90E3
5244	CCleaner64.exe	C:\Program Files\CCleaner\gcapi_dll.dll		executable
		MD5:F17F96322F8741FE86699963A1812897	SHA256:8B6CE3A640E2D6F36B0001BE2A1ABB765AE51E62C314A15911E75138CBB544BB
6180	VirusOrg.Neshta.A.exe	C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\OneDriveUpdaterService.exe		executable
		MD5:188634210BD6B3775EDCD49E20F049F5	SHA256:E2072CE8740FA81BA99901E603BAE47672A52619B6C438C4EB4937ED31FAC97E
5244	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E		binary
		MD5:2BE0D2E5E52FE2FA24FFE155F3A0DD43	SHA256:552C7807B616AACB076347E44AF70F044ACF7BAF4839831C44F12B490734B257
7040	Taskmgr.exe	C:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock		text
		MD5:F49655F856ACB8884CC0ACE29216F511	SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
5244	CCleaner64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA		binary
		MD5:654400515C87A266C309E1029F6A86BE	SHA256:A177B60F1B79564D81F371DAE5E21379EE3AF34B1158B5F3BFB7D3EE04601503
5244	CCleaner64.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\ccupdate631_free[1].exe		—
		MD5:—	SHA256:—
5244	CCleaner64.exe	C:\Program Files\CCleaner\temp_ccupdate\ccupdate631_free.exe		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4712	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6164	SIHClient.exe	GET	200	184.30.230.103:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5244	CCleaner64.exe	GET	200	2.19.126.142:80	http://ncc.avast.com/ncc.txt	unknown	—	—	whitelisted
6164	SIHClient.exe	GET	200	184.30.230.103:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
6328	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted
4328	firefox.exe	GET	200	34.107.221.82:80	http://detectportal.firefox.com/canonical.html	unknown	—	—	whitelisted
5244	CCleaner64.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAXfj0A2M0oL7zuU%2F%2F2jetU%3D	unknown	—	—	whitelisted
5244	CCleaner64.exe	GET	200	142.250.186.35:80	http://c.pki.goog/r/r1.crl	unknown	—	—	whitelisted
6700	CCleaner64.exe	GET	200	2.19.126.142:80	http://ncc.avast.com/ncc.txt	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3884	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4712	MoUsoCoreWorker.exe	2.20.245.138:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
4712	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5064	SearchApp.exe	2.23.227.208:443	www.bing.com	Ooredoo Q.S.C.	QA	whitelisted
5064	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1176	svchost.exe	40.126.32.74:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1176	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208	whitelisted
crl.microsoft.com	2.20.245.138 2.20.245.137	whitelisted
www.microsoft.com	95.101.149.131 184.30.230.103	whitelisted
google.com	142.250.184.238	unknown
www.bing.com	2.23.227.208 2.23.227.215	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	40.126.32.74 40.126.32.68 20.190.160.14 20.190.160.17 40.126.32.136 40.126.32.138 40.126.32.140 40.126.32.72	whitelisted
go.microsoft.com	184.30.17.189	whitelisted
slscr.update.microsoft.com	4.175.87.197	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted

Threats

PID	Process	Class	Message
2192	svchost.exe	Misc activity	ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
5244	CCleaner64.exe	Misc activity	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI

Add for printing

Process	Message
CCleaner64.exe	[2025-01-06 04:39:21.551] [error ] [settings ] [ 5244: 4624] [000000: 0] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe	[2025-01-06 04:39:21.551] [error ] [ini_access ] [ 5244: 4624] [000000: 0] Incorrect ini_accessor configuration! Fixing relative input path to avoid recursion. Input was: Setup
CCleaner64.exe	Failed to open log file 'C:\Program Files\CCleaner'
CCleaner64.exe	OnLanguage - en
CCleaner64.exe	[2025-01-06 04:39:22.192] [error ] [settings ] [ 5244: 5208] [D2EC45: 356] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe	[2025-01-06 04:39:22.208] [error ] [Burger ] [ 5244: 5208] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe	[2025-01-06 04:39:22.208] [error ] [Burger ] [ 5244: 5208] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe	file:///tis/optimizer.tis(1288) : warning :'async' does not contain any 'await'
CCleaner64.exe	file:///tis/optimizer.tis(1131) : warning :'await' should be used only inside 'async' or 'event'
CCleaner64.exe	startCheckingLicense()

General Info

VirusOrg.Neshta.A.exe

70D5410D4DE51C059D1E6519C0BF7715

43004AEC691EBEC79E90B6686C63A0BB2B461DD6

79DA6C92E80C7B5B5A858CAAC08C21F0CFCD0DDC865E73CC26A2E10FE04C6E42

768:1Ao4BhL0vjnyvAcb7zlCrCBEWwT0qCM2YlFCjy:cBFcjni5CrCqlTd/xlg

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

NESHTA mutex has been found

Changes the autorun value in the registry

SUSPICIOUS

Mutex name with non-standard characters

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Reads the date of Windows installation

Application launched itself

Reads Internet Explorer settings

Checks Windows Trust Settings

Searches for installed software

Checks for external IP

INFO

Process checks computer location settings

UPX packer has been detected

Reads Environment values

Checks supported languages

Manual execution by a user

Reads the computer name

Reads security settings of Internet Explorer

Drops encrypted VBS script (Microsoft Script Encoder)

Sends debugging messages

Reads product name

Reads CPU info

Reads the machine GUID from the registry

The sample compiled with english language support

Reads the software policy settings

The process uses the downloaded file

Checks proxy server information

Creates files or folders in the user directory

Creates files in the program directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings