Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
a30316e5962dca158a5bb0fc33216180_NEIKI.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a30316e5962dca158a5bb0fc33216180_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
a30316e5962dca158a5bb0fc33216180_NEIKI.exe
-
Size
264KB
-
MD5
a30316e5962dca158a5bb0fc33216180
-
SHA1
f04604a2dfeff057faa36616a4b6a51a61a0ba31
-
SHA256
7bd07859fb5e5c1be03fde08f04b5a7c78cddc32372f01d004c84a9f1e48b6c1
-
SHA512
653303495a299aa4c6fd0d7bfe1a49463525969d267954022a2f387918ec42db0f1d6ac1e44cff0159f989d2f645fb32403f2cdc4c9342cf25ef19810434885f
-
SSDEEP
6144:XBtOXTqfpui6yYPaIGck72siBTQtpui6yYPaIGckv:xtOjUpV6yYPc2siBTspV6yYPo
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqfbaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lpocjdld.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqfbaq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqmhbpba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnepih32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkiqbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpfijcfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lpfijcfl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpaifalo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mdpalp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnepih32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpkbebbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mcpebmkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdpalp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nkqpjidj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgdbkohf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljnnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lgbnmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nafokcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lpappc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnolfdcn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Laalifad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lphfpbdi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mgidml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad a30316e5962dca158a5bb0fc33216180_NEIKI.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkbkamnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mpkbebbf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Majopeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nnolfdcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kibnhjgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lgkhlnbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lkiqbl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcklgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mnapdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqmhbpba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpocjdld.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcdegnep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lphfpbdi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mjcgohig.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mnapdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njacpf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" a30316e5962dca158a5bb0fc33216180_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kcifkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lcdegnep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgbnmm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Njacpf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lcmofolg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkqpjidj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nbhkac32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kcifkp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljnnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mgidml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mncmjfmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mpaifalo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcpebmkb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nklfoi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kibnhjgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kkbkamnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lgkhlnbn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lknjmkdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lknjmkdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nafokcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lcmofolg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Laalifad.exe -
Executes dropped EXE 37 IoCs
pid Process 3500 Kcifkp32.exe 4432 Kgdbkohf.exe 1432 Kibnhjgj.exe 2492 Kkbkamnl.exe 5104 Lpocjdld.exe 3392 Lcmofolg.exe 4908 Lpappc32.exe 4416 Lgkhlnbn.exe 1784 Lnepih32.exe 1636 Laalifad.exe 3228 Lkiqbl32.exe 1456 Lpfijcfl.exe 3168 Lcdegnep.exe 3492 Ljnnch32.exe 1448 Lphfpbdi.exe 644 Lgbnmm32.exe 4800 Lknjmkdo.exe 2948 Mpkbebbf.exe 4904 Mjcgohig.exe 624 Majopeii.exe 4124 Mcklgm32.exe 844 Mnapdf32.exe 1480 Mgidml32.exe 1764 Mncmjfmk.exe 2228 Mpaifalo.exe 4100 Mcpebmkb.exe 2904 Mdpalp32.exe 2580 Nkjjij32.exe 2996 Nqfbaq32.exe 2344 Nklfoi32.exe 1772 Nafokcol.exe 1712 Njacpf32.exe 4384 Nbhkac32.exe 4424 Nkqpjidj.exe 3732 Nnolfdcn.exe 3408 Nqmhbpba.exe 2296 Nkcmohbg.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mcklgm32.exe Majopeii.exe File opened for modification C:\Windows\SysWOW64\Njacpf32.exe Nafokcol.exe File created C:\Windows\SysWOW64\Nkqpjidj.exe Nbhkac32.exe File opened for modification C:\Windows\SysWOW64\Nbhkac32.exe Njacpf32.exe File created C:\Windows\SysWOW64\Fogjfmfe.dll Kcifkp32.exe File created C:\Windows\SysWOW64\Bpcbnd32.dll Kgdbkohf.exe File created C:\Windows\SysWOW64\Mpkbebbf.exe Lknjmkdo.exe File created C:\Windows\SysWOW64\Kibnhjgj.exe Kgdbkohf.exe File opened for modification C:\Windows\SysWOW64\Kibnhjgj.exe Kgdbkohf.exe File created C:\Windows\SysWOW64\Ogndib32.dll Lcmofolg.exe File created C:\Windows\SysWOW64\Laalifad.exe Lnepih32.exe File created C:\Windows\SysWOW64\Pdgdjjem.dll Mcklgm32.exe File created C:\Windows\SysWOW64\Npckna32.dll Nkjjij32.exe File opened for modification C:\Windows\SysWOW64\Lgkhlnbn.exe Lpappc32.exe File opened for modification C:\Windows\SysWOW64\Lkiqbl32.exe Laalifad.exe File opened for modification C:\Windows\SysWOW64\Nqmhbpba.exe Nnolfdcn.exe File opened for modification C:\Windows\SysWOW64\Laalifad.exe Lnepih32.exe File opened for modification C:\Windows\SysWOW64\Majopeii.exe Mjcgohig.exe File created C:\Windows\SysWOW64\Cnacjn32.dll Mnapdf32.exe File created C:\Windows\SysWOW64\Offdjb32.dll Lpocjdld.exe File opened for modification C:\Windows\SysWOW64\Lcdegnep.exe Lpfijcfl.exe File opened for modification C:\Windows\SysWOW64\Lphfpbdi.exe Ljnnch32.exe File created C:\Windows\SysWOW64\Mglppmnd.dll Ljnnch32.exe File created C:\Windows\SysWOW64\Kmdigkkd.dll Lknjmkdo.exe File opened for modification C:\Windows\SysWOW64\Nkjjij32.exe Mdpalp32.exe File created C:\Windows\SysWOW64\Fhpdhp32.dll Mcpebmkb.exe File created C:\Windows\SysWOW64\Mgidml32.exe Mnapdf32.exe File opened for modification C:\Windows\SysWOW64\Mncmjfmk.exe Mgidml32.exe File opened for modification C:\Windows\SysWOW64\Mdpalp32.exe Mcpebmkb.exe File created C:\Windows\SysWOW64\Cknpkhch.dll Nkqpjidj.exe File created C:\Windows\SysWOW64\Nqmhbpba.exe Nnolfdcn.exe File opened for modification C:\Windows\SysWOW64\Lpocjdld.exe Kkbkamnl.exe File opened for modification C:\Windows\SysWOW64\Lcmofolg.exe Lpocjdld.exe File created C:\Windows\SysWOW64\Lcdegnep.exe Lpfijcfl.exe File created C:\Windows\SysWOW64\Nafokcol.exe Nklfoi32.exe File created C:\Windows\SysWOW64\Lmbnpm32.dll Nafokcol.exe File created C:\Windows\SysWOW64\Ndclfb32.dll Lpappc32.exe File opened for modification C:\Windows\SysWOW64\Lpfijcfl.exe Lkiqbl32.exe File opened for modification C:\Windows\SysWOW64\Lknjmkdo.exe Lgbnmm32.exe File created C:\Windows\SysWOW64\Ghiqbiae.dll a30316e5962dca158a5bb0fc33216180_NEIKI.exe File created C:\Windows\SysWOW64\Lnepih32.exe Lgkhlnbn.exe File opened for modification C:\Windows\SysWOW64\Nafokcol.exe Nklfoi32.exe File opened for modification C:\Windows\SysWOW64\Nkcmohbg.exe Nqmhbpba.exe File created C:\Windows\SysWOW64\Gcdihi32.dll Kibnhjgj.exe File created C:\Windows\SysWOW64\Mpaifalo.exe Mncmjfmk.exe File opened for modification C:\Windows\SysWOW64\Nqfbaq32.exe Nkjjij32.exe File created C:\Windows\SysWOW64\Jnngob32.dll Lgbnmm32.exe File opened for modification C:\Windows\SysWOW64\Mcklgm32.exe Majopeii.exe File opened for modification C:\Windows\SysWOW64\Mnapdf32.exe Mcklgm32.exe File created C:\Windows\SysWOW64\Nkcmohbg.exe Nqmhbpba.exe File opened for modification C:\Windows\SysWOW64\Kcifkp32.exe a30316e5962dca158a5bb0fc33216180_NEIKI.exe File created C:\Windows\SysWOW64\Lpfijcfl.exe Lkiqbl32.exe File opened for modification C:\Windows\SysWOW64\Lgbnmm32.exe Lphfpbdi.exe File created C:\Windows\SysWOW64\Mecaoggc.dll Lphfpbdi.exe File created C:\Windows\SysWOW64\Nklfoi32.exe Nqfbaq32.exe File opened for modification C:\Windows\SysWOW64\Nklfoi32.exe Nqfbaq32.exe File created C:\Windows\SysWOW64\Mbaohn32.dll Lkiqbl32.exe File opened for modification C:\Windows\SysWOW64\Mpkbebbf.exe Lknjmkdo.exe File created C:\Windows\SysWOW64\Lknjmkdo.exe Lgbnmm32.exe File created C:\Windows\SysWOW64\Mcpebmkb.exe Mpaifalo.exe File created C:\Windows\SysWOW64\Ogpnaafp.dll Nbhkac32.exe File created C:\Windows\SysWOW64\Gefncbmc.dll Lcdegnep.exe File created C:\Windows\SysWOW64\Lphfpbdi.exe Ljnnch32.exe File opened for modification C:\Windows\SysWOW64\Ljnnch32.exe Lcdegnep.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4204 2296 WerFault.exe 122 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhapkbgi.dll" Mpaifalo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mcpebmkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nnolfdcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Majopeii.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mncmjfmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mncmjfmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mpaifalo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll" Mcpebmkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgbnmm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lphfpbdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mjcgohig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mdpalp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nkqpjidj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kkbkamnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbaohn32.dll" Lkiqbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll" Lcdegnep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nbhkac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mnapdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mgidml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll" Nnolfdcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kcifkp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lphfpbdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnohlokp.dll" Mjcgohig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Majopeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdgdjjem.dll" Mcklgm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lpocjdld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lcmofolg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Laalifad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Laalifad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mpkbebbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nafokcol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nqmhbpba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdihi32.dll" Kibnhjgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lpfijcfl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ljnnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mpaifalo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mcpebmkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciiqgjgg.dll" Mgidml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nklfoi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node a30316e5962dca158a5bb0fc33216180_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kcifkp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lcdegnep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mcklgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nqfbaq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdigkkd.dll" Lknjmkdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgdbkohf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll" Lcmofolg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nklfoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcoegc32.dll" Nklfoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkbkamnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ljnnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lgbnmm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lknjmkdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mpkbebbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kibnhjgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll" Nkjjij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll" Nbhkac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lkiqbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lkiqbl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Njacpf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nqmhbpba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnacjn32.dll" Mnapdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mdpalp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" a30316e5962dca158a5bb0fc33216180_NEIKI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 324 wrote to memory of 3500 324 a30316e5962dca158a5bb0fc33216180_NEIKI.exe 83 PID 324 wrote to memory of 3500 324 a30316e5962dca158a5bb0fc33216180_NEIKI.exe 83 PID 324 wrote to memory of 3500 324 a30316e5962dca158a5bb0fc33216180_NEIKI.exe 83 PID 3500 wrote to memory of 4432 3500 Kcifkp32.exe 84 PID 3500 wrote to memory of 4432 3500 Kcifkp32.exe 84 PID 3500 wrote to memory of 4432 3500 Kcifkp32.exe 84 PID 4432 wrote to memory of 1432 4432 Kgdbkohf.exe 85 PID 4432 wrote to memory of 1432 4432 Kgdbkohf.exe 85 PID 4432 wrote to memory of 1432 4432 Kgdbkohf.exe 85 PID 1432 wrote to memory of 2492 1432 Kibnhjgj.exe 86 PID 1432 wrote to memory of 2492 1432 Kibnhjgj.exe 86 PID 1432 wrote to memory of 2492 1432 Kibnhjgj.exe 86 PID 2492 wrote to memory of 5104 2492 Kkbkamnl.exe 87 PID 2492 wrote to memory of 5104 2492 Kkbkamnl.exe 87 PID 2492 wrote to memory of 5104 2492 Kkbkamnl.exe 87 PID 5104 wrote to memory of 3392 5104 Lpocjdld.exe 88 PID 5104 wrote to memory of 3392 5104 Lpocjdld.exe 88 PID 5104 wrote to memory of 3392 5104 Lpocjdld.exe 88 PID 3392 wrote to memory of 4908 3392 Lcmofolg.exe 89 PID 3392 wrote to memory of 4908 3392 Lcmofolg.exe 89 PID 3392 wrote to memory of 4908 3392 Lcmofolg.exe 89 PID 4908 wrote to memory of 4416 4908 Lpappc32.exe 90 PID 4908 wrote to memory of 4416 4908 Lpappc32.exe 90 PID 4908 wrote to memory of 4416 4908 Lpappc32.exe 90 PID 4416 wrote to memory of 1784 4416 Lgkhlnbn.exe 91 PID 4416 wrote to memory of 1784 4416 Lgkhlnbn.exe 91 PID 4416 wrote to memory of 1784 4416 Lgkhlnbn.exe 91 PID 1784 wrote to memory of 1636 1784 Lnepih32.exe 92 PID 1784 wrote to memory of 1636 1784 Lnepih32.exe 92 PID 1784 wrote to memory of 1636 1784 Lnepih32.exe 92 PID 1636 wrote to memory of 3228 1636 Laalifad.exe 93 PID 1636 wrote to memory of 3228 1636 Laalifad.exe 93 PID 1636 wrote to memory of 3228 1636 Laalifad.exe 93 PID 3228 wrote to memory of 1456 3228 Lkiqbl32.exe 94 PID 3228 wrote to memory of 1456 3228 Lkiqbl32.exe 94 PID 3228 wrote to memory of 1456 3228 Lkiqbl32.exe 94 PID 1456 wrote to memory of 3168 1456 Lpfijcfl.exe 95 PID 1456 wrote to memory of 3168 1456 Lpfijcfl.exe 95 PID 1456 wrote to memory of 3168 1456 Lpfijcfl.exe 95 PID 3168 wrote to memory of 3492 3168 Lcdegnep.exe 97 PID 3168 wrote to memory of 3492 3168 Lcdegnep.exe 97 PID 3168 wrote to memory of 3492 3168 Lcdegnep.exe 97 PID 3492 wrote to memory of 1448 3492 Ljnnch32.exe 98 PID 3492 wrote to memory of 1448 3492 Ljnnch32.exe 98 PID 3492 wrote to memory of 1448 3492 Ljnnch32.exe 98 PID 1448 wrote to memory of 644 1448 Lphfpbdi.exe 99 PID 1448 wrote to memory of 644 1448 Lphfpbdi.exe 99 PID 1448 wrote to memory of 644 1448 Lphfpbdi.exe 99 PID 644 wrote to memory of 4800 644 Lgbnmm32.exe 100 PID 644 wrote to memory of 4800 644 Lgbnmm32.exe 100 PID 644 wrote to memory of 4800 644 Lgbnmm32.exe 100 PID 4800 wrote to memory of 2948 4800 Lknjmkdo.exe 101 PID 4800 wrote to memory of 2948 4800 Lknjmkdo.exe 101 PID 4800 wrote to memory of 2948 4800 Lknjmkdo.exe 101 PID 2948 wrote to memory of 4904 2948 Mpkbebbf.exe 102 PID 2948 wrote to memory of 4904 2948 Mpkbebbf.exe 102 PID 2948 wrote to memory of 4904 2948 Mpkbebbf.exe 102 PID 4904 wrote to memory of 624 4904 Mjcgohig.exe 103 PID 4904 wrote to memory of 624 4904 Mjcgohig.exe 103 PID 4904 wrote to memory of 624 4904 Mjcgohig.exe 103 PID 624 wrote to memory of 4124 624 Majopeii.exe 104 PID 624 wrote to memory of 4124 624 Majopeii.exe 104 PID 624 wrote to memory of 4124 624 Majopeii.exe 104 PID 4124 wrote to memory of 844 4124 Mcklgm32.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a30316e5962dca158a5bb0fc33216180_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\a30316e5962dca158a5bb0fc33216180_NEIKI.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\Kcifkp32.exeC:\Windows\system32\Kcifkp32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Kgdbkohf.exeC:\Windows\system32\Kgdbkohf.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Kibnhjgj.exeC:\Windows\system32\Kibnhjgj.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\Kkbkamnl.exeC:\Windows\system32\Kkbkamnl.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\Lpocjdld.exeC:\Windows\system32\Lpocjdld.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\Lcmofolg.exeC:\Windows\system32\Lcmofolg.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\Lpappc32.exeC:\Windows\system32\Lpappc32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\Lgkhlnbn.exeC:\Windows\system32\Lgkhlnbn.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\Lnepih32.exeC:\Windows\system32\Lnepih32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\Laalifad.exeC:\Windows\system32\Laalifad.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Lkiqbl32.exeC:\Windows\system32\Lkiqbl32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\Lpfijcfl.exeC:\Windows\system32\Lpfijcfl.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\Lcdegnep.exeC:\Windows\system32\Lcdegnep.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\Ljnnch32.exeC:\Windows\system32\Ljnnch32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\Lphfpbdi.exeC:\Windows\system32\Lphfpbdi.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\Lgbnmm32.exeC:\Windows\system32\Lgbnmm32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\Lknjmkdo.exeC:\Windows\system32\Lknjmkdo.exe18⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Mpkbebbf.exeC:\Windows\system32\Mpkbebbf.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Mjcgohig.exeC:\Windows\system32\Mjcgohig.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Majopeii.exeC:\Windows\system32\Majopeii.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\Mcklgm32.exeC:\Windows\system32\Mcklgm32.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\Mnapdf32.exeC:\Windows\system32\Mnapdf32.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:844 -
C:\Windows\SysWOW64\Mgidml32.exeC:\Windows\system32\Mgidml32.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1480 -
C:\Windows\SysWOW64\Mncmjfmk.exeC:\Windows\system32\Mncmjfmk.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1764 -
C:\Windows\SysWOW64\Mpaifalo.exeC:\Windows\system32\Mpaifalo.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2228 -
C:\Windows\SysWOW64\Mcpebmkb.exeC:\Windows\system32\Mcpebmkb.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4100 -
C:\Windows\SysWOW64\Mdpalp32.exeC:\Windows\system32\Mdpalp32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2904 -
C:\Windows\SysWOW64\Nkjjij32.exeC:\Windows\system32\Nkjjij32.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2580 -
C:\Windows\SysWOW64\Nqfbaq32.exeC:\Windows\system32\Nqfbaq32.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2996 -
C:\Windows\SysWOW64\Nklfoi32.exeC:\Windows\system32\Nklfoi32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2344 -
C:\Windows\SysWOW64\Nafokcol.exeC:\Windows\system32\Nafokcol.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1772 -
C:\Windows\SysWOW64\Njacpf32.exeC:\Windows\system32\Njacpf32.exe33⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\Nbhkac32.exeC:\Windows\system32\Nbhkac32.exe34⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4384 -
C:\Windows\SysWOW64\Nkqpjidj.exeC:\Windows\system32\Nkqpjidj.exe35⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4424 -
C:\Windows\SysWOW64\Nnolfdcn.exeC:\Windows\system32\Nnolfdcn.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3732 -
C:\Windows\SysWOW64\Nqmhbpba.exeC:\Windows\system32\Nqmhbpba.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3408 -
C:\Windows\SysWOW64\Nkcmohbg.exeC:\Windows\system32\Nkcmohbg.exe38⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 41239⤵
- Program crash
PID:4204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2296 -ip 22961⤵PID:1360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5ee6c7b76d30d24fc31c65d823c7550d0
SHA152bb26ad3be54d0231508a657156e2f83a4e8e73
SHA2567302fd1822a9b89611bc6826c41a2229ac42e29e608e1fcb5385d413b2c17fbd
SHA51238053c18415fbf5828f60b3200ec0def87a23e3ee214ed749f36176e2a3a6ff35178ba25bf630ccf33c745e4e35cdb1a9532f539b6a676b17ab21b615b73aef9
-
Filesize
264KB
MD594bb544116c1be0daa556ae94a457bba
SHA111df8b64d781edd8ce299518292968556470c5a7
SHA25670cd9db3c1e853487024144a0711ea96d12dbbc5bf115807f906c297d41041df
SHA5127bf37bbfd7a4cd31add118272c4a606a0b85f94b3f401b606e76ff30fb6a3b5a1f6de3db957baca7507af76e1bd4b3d2fe0f719b0fbefccd67a94353a7d1d0e6
-
Filesize
264KB
MD599252da39bb17c6befa448cf01a5dd4a
SHA1f8ed8e067f3f07a31665ba484c49e0627024adc6
SHA256ba78636595693e6e3d839660bf7292b7cff9dd61fc952df4fd0e072cefaadb69
SHA51228e603d2a8fb247eee9636fe070ebb2a01904f43ddc281d255c8179e79f237d9fd4fa4a4794a0690b76ad6cb6cf69115646a70ffd0e581cb59e89ce8a5bf368c
-
Filesize
264KB
MD581598f4dcf56bcff9dec65e8941588c5
SHA1de85b904b9550ba7239a459ff2c0e287aa6ade1d
SHA25627206566867a2935c08c875a78b894945e30cc31dced3a22ea2a8a7bb8465835
SHA51273dae4b9a664afe7cc975ff0f0956795fdedd66ebcc18927083193d9a51a9554bc1a0fae32dc74824c0ccf3e901998a64da0cec26dfe9e5bc0ca6eb7152f0e1a
-
Filesize
264KB
MD5e34bed622a56c3b89c1cbd75d5ff70af
SHA1de119a2fac10872d834dc86300c9a3eef64b6873
SHA256649afa7951eff87f1d252207f76784fea56d7fd0dbadead7c8b8080c8a18f0a9
SHA512c554e811b422e406b69b5fd3d0fed22ddd560b7026d907c2226a9ae9ac2db05d49b84cef617b386acf051dfb33d52fe78950c4737abc53e3ea69f55c6f182559
-
Filesize
264KB
MD5294b00100016be4f68ff1e27f75f9e84
SHA1c7e09ce74d99f0ec19b9431986c284fc33242b0e
SHA25684148dc8e0fa2e2a28c7d6aef8db65501f45ab4dd93470ba58ec7618f295e9ab
SHA512ad5276cc6a43ba60297997380b7eca06bf8c7759b7bd03241329f3b1051fcba9c96ebfea50625934ddaa909ebf52217e33b8830c2f0babb9eb514792b5933f28
-
Filesize
264KB
MD5ccb8431f9e2a2dc51dc7fe71e2abb28a
SHA167e26ba65872e7b16435a3f27f49167bbb314bec
SHA2562411f07c26a378bf95681ced8c95c8dc030c3751065a93d6367fdde9d1db24dc
SHA51227ebdc3d163ed7f40a0ae7b405c4607eabc2d652dca2e34ce74bcf589639a2eed5f5930bef37731533010637aa5d17511b6bde32a74b5b5e8a8748bf267c7a9e
-
Filesize
264KB
MD50ea1c94753ad3e2d9f66e17d44ce8cc6
SHA1dc890da8a0989f4ac00ce57023f872f426dad089
SHA256ac81a9f9a034c9b2b7a187e0a74ec1653b4c516c567a6ada7525dce1b6f8e0f0
SHA512441a73f2377cdd8690244aded37a8769a3cc9dd52add2ce7af7d17ffcd6df61ee8afa4fb98952c5f735fec011fa14d5a12b6d970743d72c9fd4e6799037c9748
-
Filesize
264KB
MD56e8fb613a87590a33f8c6581c3b52d80
SHA17efc9202f016aea449b30d965be9c9aa0de592cb
SHA256779a1b4b5bd2c71116a6c9945047afb7391f3aee051e34c93968d531d47a9c08
SHA512e79b5db42bc4c043e43e8330987a12051300b5b6144e0443e20a657502789cf148e623f61fc7cb8b87e7b66c8f6eef87988bb1e5cbbac2b32ec70f500684dbdf
-
Filesize
264KB
MD501300afc307a4ac1d7d21497f5811038
SHA191076a86ccfb38fa5076ae48aecdc9064ba29679
SHA25634fe39a2cd3a9ebfc85c237427bb29827ab15acf27ea6d2f690e5796ae7f9d5d
SHA5120c9c8e38f913bf4a7e71401deb4eb69a9371be51c21af5d1b6d8bc680805771bdbee1940f07d190b9ffd295a45707506262f5a3f928d5200eda1704f7ee43df9
-
Filesize
264KB
MD5bcac428cd41f4d33d8c2a6b336012307
SHA1cbb88b4a8fd22c0207c8b161ec3a4751fb41799c
SHA256300a9b87491bc8172816e21b1aead4b4f29ced72f5ac0120701a9f437c565c47
SHA512223aa6cd271c3a44f61fc3e36bd6b21fc4e05cc31578c6db0ddd17777dcb63fd8edb5b542b6b9eb2ea164aef8466a08ac3f22708247d2d234e0148fd89e629cd
-
Filesize
264KB
MD526faba43deecd365d48412806151a9d9
SHA1326a6e73db4ec7834ca17277e009ece4d27ce963
SHA25674991ea2e622219446f98dd192a605d51480b1b43b2c688f532b2a974094be62
SHA5123eb81cdd2defad41287bea40d3cdcf3d5008379c7b77f3994bd050ecf5f6f4d8044eedc25f3eb5196853cbc651c27b1fff7a85450fb180f31400b59c38ef3f70
-
Filesize
264KB
MD5f32def214811a3177e5c0e9388ba7452
SHA1c842ef1ffabf167caa7c71d164df12bc88aa24c3
SHA256a7dc0a3d5a817f5e280329bfc20a5da7b9297a1823ad837cee107d42b3bb0169
SHA5127201436921a5639f5e2c56edd2635b540c7835aa7a191b87ccc6b5b73412e165934cda39f33bc19d4f868a5937f6db6d10247e335121312b9af34c849e9d869a
-
Filesize
264KB
MD5b7cac42b93cfd3d775e3cd0cf061cd46
SHA1f34d89b305187e85572f5e196808f41e83a650a8
SHA2563de916d988659a4c21f3263bd2e9b402d0d81a6727ab62805973c853abb34f7f
SHA512f5332f6aa7d7d330451968f6c5a85c7039992965e348ffa828281488629a7368ee9fccc1669b62279a55a9e213539bf1392a09e1c58b243824b3a9287f75fa8d
-
Filesize
264KB
MD5c668b48c15198568a97fed39f3cc6ce4
SHA1e88f7e91b75fa5ddaf8e2a2f2b2a0290e0f68686
SHA256d297e987de682763e2dab885318a6707cdec0c6f067accb6eac156e69a3a9db3
SHA51273d70710e431041bce78d80de6f2107f46f40915c5726032fc4694ba56ca277d4494ec617505d6d0af7243a1641628e487e830b3dd20e474c50d5cfc4ad8b934
-
Filesize
264KB
MD5f41a3b6a6392e7c883539a2115ffb33c
SHA1896c00c501d2750565db3e3a38e37b040311e65d
SHA256704bd0013ad30630eb92590db452f05dfed8c6cbb0b238ad8c3aa9f2a6259f14
SHA5127c0dccb1cd90dcfac2727ff8790610a43b45468242992d5f88d93f98b4fedebdf8e2b55c176fcd376993a77afe6332745f9c2aac393f17159a4cfb33fa7beb4b
-
Filesize
264KB
MD5754207ae3d3974023e0e55d2d280a099
SHA1b9072091762aa76bdb6696971def40c75a6e0aa4
SHA256be822a99196f4b2ad3314e05df5bc873c7f0124028603005d9335fddfc2bdfad
SHA512f3fb7ae08404d32e79e513b107cb3b21aee7abd9890a4936008d5bc624c47833dbd88ca60f59937440c5c8e5bca5a69c1c4dd373d8147b69c0a73b255f07c9d9
-
Filesize
264KB
MD5cf8b7746112392f0c50b25252cbaee6f
SHA1b1a85ed339e4bc3ea1dcf832e75d0cb697aaad70
SHA256ec77bb5a45dfb77222ce82d90628190ae35bf5a853f60593adb8c833c6b76d06
SHA51262a06a128b708ca877b6b5d385e109a082935f62a50e7fd6954bc3b26979ac1fb69b9a96e8cce9f361b3cde325d1639147d83e8cc4dfa0eb38ad36b18a6b0238
-
Filesize
264KB
MD560ca52be923073d7faf900ecbdd2d4f3
SHA10052caa9651a3d24ee578d668ef6b71804aadf38
SHA25626cecd05e8c4af6947074eef6342e455b2b84995a231401b9f19198e85d42448
SHA51253119e40e707dff67cc4ad54c1dd997eff55b802d8075de684592ba160321ccfcf7da70e6341d067e558248e99e6b0848f926855314f9d03f9f3279a80ae0cd5
-
Filesize
264KB
MD589bef5b6c9841dd281fe5eb529c669ed
SHA1db2de6233e6342986bf790ed12dbcad38aa6214b
SHA256579a14feb48e735a6e72969bb37a9546a016f1ec7fd4eb71558a4a42fff14c46
SHA5122d05bb406bfe47c9539df9e26f2bd2937d363a9c4b9ed537c33508edb435b64778125957040af920cd785d2fb2fc1ea7ea343a0e8f3f6c1d906f3882155f859e
-
Filesize
264KB
MD5e7c601282b68d5c829b11de03f652073
SHA14ef611e6576c4efb911181e73d3f9c3237df26ed
SHA256aef0df6f86815d923b22b95a6f2acdecae23bb4408f5e23d200bf16d111ffb12
SHA5125763c4b6f273da2e8dc08abe7a9adbc3abeec6436fb0a1bdccee6ba21b13a511ab46ba1c32fb9c4d273aa04a157e2e0a18b3427f8b22170a647b2fdcaf7e7ef2
-
Filesize
264KB
MD5f36e10a2dadab19249f71f61270b792d
SHA1cfddd80ebce74222021755c4565bf7bdd5bcc4aa
SHA256a5287048767c0203f66c490bd7a0af37f1a69257c996f5a62a21fb31218e02e3
SHA5127ef190e4c403626ea10671e241b324cb7df3e260fc1f8e4e4685292e4b729a1288ea74cf3732fe8d17464ccabdbd09a2670bb81c197606a5e86330350e3f752f
-
Filesize
264KB
MD5c4d73d8654fd7a078ab5aac7b33f984c
SHA11b5fc7b861f60abd825513a11fe8f476cb90d54c
SHA256ca207006ca08d26746f562103107882ae3671ea4b6aa8e6022fec3de5a3ee4d7
SHA51209f59affefa402db5785b1d8380b27c12f0d8c23b51123f4ec5f3cf127b9038eac6efe358c7b844fdb124c24e3da4fcd5b38de17b62ef50738f95c8c7b9ddba6
-
Filesize
264KB
MD5abd6bac518dfcf08554b2a07dfd70f5d
SHA1a95eb0ffa5678823bd2102efe348d5417b65d03b
SHA2569e2c7e9267ed3b0bc9c8ec9e7cae15f5338c940209926dd338170baf7f967369
SHA5129ce6e68f15524680a55d824cdfe7cb6230230e9abb5acf0a38ede94bffd149d9758234da9c3ea4465053f1f8c54ae3d7a955703d869584a2f6a7160f2548c01c
-
Filesize
264KB
MD5dd09533e9cf86d7363cf44aa487046f3
SHA15f26c776d412ec2ec48554e90358497a214a258d
SHA2568dbe48da29d9d7257d7b0bc2f290a57e59da6b6c71b448d15d64003f80afc403
SHA5123f72a0cf495ba6d968f16041c951eb2b87eb35e5222d0a46486cdd0d89de091fa55a081327ab36ef25d42666daf9ad5e408a58268bebbf6ef394b66f8ce70f38
-
Filesize
264KB
MD592dcbe30d80ef6f42ef10d2597e47f1e
SHA12c4a7f2f1c252d87411338c67a3794a9f34bb4e6
SHA25648f4482fce7c0ee636448aaa4196d11a6c7fa3892979623e637700e9aee17058
SHA512b2e5f1c9705fd0f02d6020e25983cbf5b6814890edec3954081ac6a3b8bf51ee6f5d8b832361ec5fb4d38fe1bee2a161f4b87f3dcf3c2fb6c30d4419d7f963ee
-
Filesize
264KB
MD5e53a7216dc7e193d16f55d2ee49e9cd9
SHA13fd8dd025503331dc4c7a1e1bbfd36784bcbd38a
SHA2569a6107d809aee00925ba30469d177187e7f3aee57fdc614ba572af0355719ae7
SHA5124284974d3330db0d13d0c4d84704dc6a618e2d2e7f3c0f7a85bb7c0299baa5afa538d4fa2b714194a0d56e04e2dd2556ff6ac98534f3461b523ed9e05f766689
-
Filesize
264KB
MD5990cbbf3a31bae9facc180fbc58d76b9
SHA192817c60938b8a3063ec9de00dc2f6c45da73696
SHA256dd1fe88ae5a0a87e5d3f9a7cac2563b9aeff004d97fdf7bbfe3af7ba1f284902
SHA512f62ca9d95bf8fb53093d134e578683470fdba51ee0524976e11e5c40190743c8a46cfd584a772fe7a947d1c4146aed8501efd5f35de0fc14654775ca71907747
-
Filesize
264KB
MD5b88b25b7cf27340e3abb0088582ed1e9
SHA19f5098a493e6a8484d8920aba38bea2551632f8b
SHA2568e38797a6dde83ba1d7ecc572d9ba6de53f88e0b3292ea29ef6142dbeb052015
SHA512e6c18de16cfb639d7e3169eafc44a31a3121db0818b573a7d08a7157b922b27dcc3b8b33631f57756875324061b445132184bf8ee04ba0e826f1fd506458cc6a
-
Filesize
264KB
MD5454069d31dee07e1f9cafab15ae80c48
SHA1c560805f3e3ae432ff90cb5c62d006c153841d82
SHA256e58af7174dfe8b6eef97b7750d37c4546a91389dc8d4f38dd66165700265b67e
SHA512487dd5f8a72dbcdb8a2c2ca1bb0ce6220d22cfe5a29fb9b5f1d0afa67c7d75373047b9e061fa13eade7352d2bd11291935e07e48376d5d430cf6674b76b4f7b8
-
Filesize
264KB
MD5c1ab1accda7d46d294b46cbb98c40e40
SHA16478c5c729eb36aed283f37d585c92f2f3d0671f
SHA256f7c599faa3a678c861b5249d9e67bdee6d0d0290a102d8fd24234fb5b8f75b77
SHA512cb24dee17f28749d685556cda69a51782a47e31ad2293b63d2a7d456bcfa1c5582ab70de2969bc0efe4b1d553611b52069a045c8560002449ca3654d13fa74fd
-
Filesize
264KB
MD55f415b24aee3576f08d6f5c6412ee304
SHA12ed821c54180ec220d6877850417e92991be1ffe
SHA2562ce91624be3e0d457f2ebe18d355abcf1acb0390bfa9bdafb3e07b68e3087de4
SHA5121fef71de21be838415aa2dd8071a823242ca6d3b7068b0f32aeceba4ed28ab10edaaf4276b1ce955b8cb9a30338271ee69f2f548652e89a2016eeaba53abdb5d
-
Filesize
264KB
MD5c57379242389febc31c09a5bf599ba5e
SHA11bfd611197cbbdac63ec86ca5767339154c4c2ba
SHA2562858e06aa0a838b981668425eb5bfa75d6a2b61fd26b1804af74c67e1bdebd3b
SHA512a35d7cc892e7639884cd4d61507c827203a839a05c1fb3c15d82081a2f617b5a057e822378f642205a234f3910cfe4112abfaf9d1d7f3ae32fe91ad81031b8b4
-
Filesize
264KB
MD531c0a7740eb705262e622ef73964e0cd
SHA1078ecf7fa684b409a0e1194ffbcae2302adc76ca
SHA256f66a6ec6d817c6f54794555d0c3a91ff9cd01b3527f9b4d72195f2af8ae8407b
SHA51207a3d1cc90c43df4c1b97a766c593ad6b567d98292b6987cf956547b057b7c20a0a5c122d7cd27e14ee52f1db863edb330ad664086ace021125500add870bff8