zgrat | 105661772dbcadfa0e07c1d790efb26adce0e54d33ecb6bee0e42ae201eecef1

Analysis

max time kernel
126s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Size

1.8MB
MD5

9c9cfb46f054ba152005a24e4bc13cd0
SHA1

894e8cce959ed8d0fccfefa585891f5fd85c6aeb
SHA256

105661772dbcadfa0e07c1d790efb26adce0e54d33ecb6bee0e42ae201eecef1
SHA512

3923648a5708f884150318bb5ee9f4df2713bd826b85861bbf2cf1026487ab8b1d5668e361081493ab4cd8b3ede7b7cf9bd173dc7b72eaf95c4082b20aad98a4
SSDEEP

24576:P+ss0unD9Gm7yQGbSMZ6/YnFAHZ5r24ZPW5HuehnP2uC/X2nLU:PM5H78bSEnmxZ+Juehnc/2

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/2836-1-0x0000000000FD0000-0x00000000011AA000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0006000000016d85-24.dat	family_zgrat_v1
behavioral1/memory/2144-49-0x0000000000EA0000-0x000000000107A000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\sppsvc.exe\", \"C:\\Users\\Default\\Recent\\audiodg.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\spoolsv.exe\", \"C:\\Windows\\Downloaded Program Files\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\Idle.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\sppsvc.exe\", \"C:\\Users\\Default\\Recent\\audiodg.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\spoolsv.exe\", \"C:\\Windows\\Downloaded Program Files\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\Idle.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\sppsvc.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\sppsvc.exe\", \"C:\\Users\\Default\\Recent\\audiodg.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\sppsvc.exe\", \"C:\\Users\\Default\\Recent\\audiodg.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\spoolsv.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\Downloads\\sppsvc.exe\", \"C:\\Users\\Default\\Recent\\audiodg.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\spoolsv.exe\", \"C:\\Windows\\Downloaded Program Files\\csrss.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2448	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2448	schtasks.exe	28

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
2144	Idle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\Idle.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\Idle.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Downloads\\sppsvc.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default\\Downloads\\sppsvc.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default\\Recent\\audiodg.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\spoolsv.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Downloaded Program Files\\csrss.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\Downloaded Program Files\\csrss.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Default\\Recent\\audiodg.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\spoolsv.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe\""	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC42E97CB6EBA840E98D1EF51BA7FC9ABE.TMP	csc.exe
File created	\??\c:\Windows\System32\u7e72d.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\6ccacd8608530f	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\csrss.exe	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\886983d96e3d3e	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2548	schtasks.exe
2476	schtasks.exe
340	schtasks.exe
868	schtasks.exe
2320	schtasks.exe
1524	schtasks.exe
1916	schtasks.exe
1580	schtasks.exe
2196	schtasks.exe
1864	schtasks.exe
556	schtasks.exe
2208	schtasks.exe
2584	schtasks.exe
1492	schtasks.exe
2316	schtasks.exe
1604	schtasks.exe
1648	schtasks.exe
536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
2144	Idle.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2144	Idle.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2580	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe	32
PID 2836 wrote to memory of 2580	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe	32
PID 2836 wrote to memory of 2580	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe	32
PID 2580 wrote to memory of 2024	2580	csc.exe	34
PID 2580 wrote to memory of 2024	2580	csc.exe	34
PID 2580 wrote to memory of 2024	2580	csc.exe	34
PID 2836 wrote to memory of 2452	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe	50
PID 2836 wrote to memory of 2452	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe	50
PID 2836 wrote to memory of 2452	2836	9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe	50
PID 2452 wrote to memory of 2616	2452	cmd.exe	52
PID 2452 wrote to memory of 2616	2452	cmd.exe	52
PID 2452 wrote to memory of 2616	2452	cmd.exe	52
PID 2452 wrote to memory of 272	2452	cmd.exe	53
PID 2452 wrote to memory of 272	2452	cmd.exe	53
PID 2452 wrote to memory of 272	2452	cmd.exe	53
PID 2452 wrote to memory of 2144	2452	cmd.exe	54
PID 2452 wrote to memory of 2144	2452	cmd.exe	54
PID 2452 wrote to memory of 2144	2452	cmd.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tmkw0gqi\tmkw0gqi.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FB8.tmp" "c:\Windows\System32\CSC42E97CB6EBA840E98D1EF51BA7FC9ABE.TMP"
    3⤵
    PID:2024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cy8ISVXXgP.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2616
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:272
- - C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe
    "C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default\Recent\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Recent\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\Downloaded Program Files\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics9" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics9" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\9c9cfb46f054ba152005a24e4bc13cd0_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES2FB8.tmp

Filesize
1KB

MD5
9f9c25531140b51433e397aa78516839

SHA1
a3b95b2ddf33f797c7072f40c3bd7475ed541822

SHA256
eebbf1835b4f5d41ad5037835164630ad0da323ecd714059e0b987e27709b93e

SHA512
e2fb885f80abf2230f52fbd64dd67f082c4cb1362ac8ebc25c96d637a2407b84ad4c3e312742bb6409968ef40d99935b2793803b3f8c943624327f6c4e096d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\cy8ISVXXgP.bat

Filesize
234B

MD5
997e755e20d49d06d4c16d4f69e10784

SHA1
a149db9f5cb73b14f9bd60b080a78fc279616b28

SHA256
d49a2de3f6c70181c42898201a9c6fc427d8e3e75b45e70fc08ac1724b3d4f7d

SHA512
eb477dd236877fc79da5f826117b11a17322abc29d5f5d3552c5c624af5d6025bf54ba8f51d7f73cd59086ed105c323866de6a7929115254b8f0c7dfef905111

Download Submit
C:\Users\Default\Downloads\sppsvc.exe

Filesize
1.8MB

MD5
9c9cfb46f054ba152005a24e4bc13cd0

SHA1
894e8cce959ed8d0fccfefa585891f5fd85c6aeb

SHA256
105661772dbcadfa0e07c1d790efb26adce0e54d33ecb6bee0e42ae201eecef1

SHA512
3923648a5708f884150318bb5ee9f4df2713bd826b85861bbf2cf1026487ab8b1d5668e361081493ab4cd8b3ede7b7cf9bd173dc7b72eaf95c4082b20aad98a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tmkw0gqi\tmkw0gqi.0.cs

Filesize
369B

MD5
e8eb652a53aa4ca8b5fa2c826aededeb

SHA1
c57b622e1435b3e25e872416c78fa3c4421ee012

SHA256
e26c92c65129475b22cc9bc3dab758a3f5a87cd8893e8907278ed122252f78fb

SHA512
9fad7bf8270feb9776e009682907d459d6884749c168ec5b5d7b441bdc5a00718f030c078a26bc050f358927c2c31d2aa60e31aa69c7cacb975b47011efad6af

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tmkw0gqi\tmkw0gqi.cmdline

Filesize
235B

MD5
9eb425b515c1ac1bbd8ab191a628a73d

SHA1
a3bfe3c5b71d756c08dd6aea3aa9ab6aa1e5ddab

SHA256
37b8425ca82440b74fdd022f6ee673e041c34d67779eb346fd937a910f5988cc

SHA512
cacc2ddba84f7689e76c088c3bbf494824f904533d1142f38fe710a1231d745fa4fbabf20c5abfd0547734c8c6cdbf860349fdc721f7474758e27af466bb7035

Download Submit
\??\c:\Windows\System32\CSC42E97CB6EBA840E98D1EF51BA7FC9ABE.TMP

Filesize
1KB

MD5
984924caf6574026769de34f35c2358e

SHA1
6dd41e492235d812252231912aa025f47fa7a9e7

SHA256
2bf5f65c8161575847113a1b4194625204c6ddce042f9b3432011c31348bb986

SHA512
5918fdc8d27ff5421dea1455df93c6cf85738e94c5079701ba7fded59b01bda482b70e2a500ba2c2aebedb6d2b0815d094d9bb271133de738f9e630167f6be46

Download Submit
memory/2144-49-0x0000000000EA0000-0x000000000107A000-memory.dmp

Filesize
1.9MB

Download
memory/2836-6-0x0000000000270000-0x000000000027E000-memory.dmp

Filesize
56KB

Download
memory/2836-28-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-13-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/2836-14-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-9-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-26-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-27-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-11-0x0000000000450000-0x0000000000468000-memory.dmp

Filesize
96KB

Download
memory/2836-8-0x0000000000430000-0x000000000044C000-memory.dmp

Filesize
112KB

Download
memory/2836-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2836-4-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-3-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-2-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-46-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-1-0x0000000000FD0000-0x00000000011AA000-memory.dmp

Filesize
1.9MB

Download