kutaki | hxxp://raagamayuribuilders[.]in/jastef

Analysis

max time kernel
163s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://raagamayuribuilders.in/jastef

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe	NEFT_Copy.bat

Executes dropped EXE 4 IoCs

pid	Process
432	gdnppvfk.exe
3192	gdnppvfk.exe
1660	gdnppvfk.exe
2356	gdnppvfk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2324	taskkill.exe
2060	taskkill.exe
1468	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133379333030002035"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1608	chrome.exe
1608	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe
Token: SeShutdownPrivilege	1608	chrome.exe
Token: SeCreatePagefilePrivilege	1608	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe
1608	chrome.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2288	NEFT_Copy.bat
2288	NEFT_Copy.bat
2288	NEFT_Copy.bat
432	gdnppvfk.exe
432	gdnppvfk.exe
432	gdnppvfk.exe
5032	NEFT_Copy.bat
5032	NEFT_Copy.bat
5032	NEFT_Copy.bat
3192	gdnppvfk.exe
3192	gdnppvfk.exe
3192	gdnppvfk.exe
1484	NEFT_Copy.bat
1484	NEFT_Copy.bat
1484	NEFT_Copy.bat
1660	gdnppvfk.exe
1660	gdnppvfk.exe
1660	gdnppvfk.exe
3284	NEFT_Copy.bat
3284	NEFT_Copy.bat
3284	NEFT_Copy.bat
2356	gdnppvfk.exe
2356	gdnppvfk.exe
2356	gdnppvfk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4440	1608	chrome.exe	82
PID 1608 wrote to memory of 4440	1608	chrome.exe	82
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 1348	1608	chrome.exe	85
PID 1608 wrote to memory of 5012	1608	chrome.exe	84
PID 1608 wrote to memory of 5012	1608	chrome.exe	84
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86
PID 1608 wrote to memory of 3460	1608	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://raagamayuribuilders.in/jastef
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4c799758,0x7ffa4c799768,0x7ffa4c799778
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4596 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,15162583120644287975,17649792588192879187,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:2288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:432

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4648
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im gdnppvfk.exe /f
  2⤵
  - Kills process with taskkill
  PID:2060
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3192

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4656
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im gdnppvfk.exe /f
  2⤵
  - Kills process with taskkill
  PID:1468
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1660

C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat
"C:\Users\Admin\AppData\Local\Temp\Temp1_NEFT_Copy.zip\NEFT_Copy.bat"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:3284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4872
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im gdnppvfk.exe /f
  2⤵
  - Kills process with taskkill
  PID:2324
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1008B

MD5
e89eabb650c3b1fda2b0f4183aebc8a6

SHA1
82ed6f8b885f396f86f3a70ed26984fcc8d77078

SHA256
a7ab2be62f74b7ff0be30cf332f292419ee5982d0fca2fe1306da406e472027e

SHA512
fd44b933e82dbee07534ebf9f098662bbbb3f7e406ae2d6e2fd89693c713d2e1421b4bdc97d88592883c12949f27b3cff228833bceb8fe56ac5b17afc5da2dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
04fd23720f6d8b741dc52ec3aa481cb7

SHA1
eacac7b0d262b469531480515bd95984d556652c

SHA256
074dfd273aec047ef68eae14376fe3ff225d0da100fd60894f004c107a6c88a3

SHA512
aa34cc4ccf28f5496e710c0d93fa70993a82da50579e70cd0d80ef86331bef60cc9bc5fc5a382bcfad491093881a64fb80ae3853c28f3f1b6fc2cce5da21ad0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1e9a1dd7cd96f3c17a437973f77ebb7b

SHA1
52def273c8ba8c8f834b1e804f2825b13d087ad2

SHA256
0896375075e8ac4f77754342ef7ddc8a2870fce4fd2544d9b7aa48ea692ba561

SHA512
201eb953226f1673dc3c95a46644453e45f2827b71ce1763745207db4f0ec7a88bd55a2ed3b4366dfa18a63ab22e314d5329e623eb5167db773cdcfffbea775d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
4c74e80f3681886b88f935219487b7cb

SHA1
64ef263cebf007cac9feda3b52cd42f1ba79a56d

SHA256
81b52bda241cbf7543d0cd987dd88c4a963afa3bc71b0afd01517ec7a1dd3df1

SHA512
1ac0b841edcb301f586556c63c50307f8ac425051fb325ecd696d774363a193543eadaa0c428af07ae06458e661393cfbcb0110de1045c32b63e0baa08974bd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdnppvfk.exe

Filesize
2.3MB

MD5
9c153ac25f02739019b04b0a8ce82c4b

SHA1
64136c4238d140a6fb1ec542744ff90aba5bac09

SHA256
83269040e4f510f11a327807b23dda45d98386676fc309e27b3eebd9cefa8416

SHA512
a7a9bb1eee5470bb4939d61df33c3840fe69e8503e792d474d7fa273f4c77dd42c84a8e6bdd78b3b157b7aadada401c903e46d3237fa5fcfa6f7b27c477bb4de

Download Submit
C:\Users\Admin\Downloads\NEFT_Copy.zip.crdownload

Filesize
2.1MB

MD5
d0f2c2de0407cefe7a24c8eb22237a61

SHA1
a46ba89e46a3d04fd9c919837441625ddaa4febe

SHA256
23d3f3b9c74b6707db237bdfa797d7425f18938614051ddb633712a42e7f3c96

SHA512
c59e010a958a1f714bd064592d6b0f26619b2efc879a1b8496d6132a598aa5edddec2e6537c34b1944893926f7664a989bf8df752f8bfffeabae4d3f7fbfb3e3

Download Submit