83c8ed621fdb4634a042aab4002b18c6bf7ddbe57fb07edf923a2e3a5b7c2f1a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe
Size

64KB
MD5

b47adbbba7eda6e9b8eb04c12f6d86c0
SHA1

34792f7e9b9db434a75c60d1e1d8e46bac0bb5fd
SHA256

83c8ed621fdb4634a042aab4002b18c6bf7ddbe57fb07edf923a2e3a5b7c2f1a
SHA512

fc3c0bcdfbca2837fec634264aa56789915adfa570a86e7db711c1db59ad3095a3b939fd2041190fbd0454170cccef43a33332cdbfcde79b1b85e7f656e2bcfb
SSDEEP

768:Ovw9816vIKQLroC34/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVdS:6EGq0oC3lwWMZQcpmgDagIyS1loL7WrS

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C038EDE5-5B27-4066-905E-BA37B8782B2E}\stubpath = "C:\\Windows\\{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe"	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A461564-DBE4-4650-9AD8-40D89D88B27D}\stubpath = "C:\\Windows\\{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe"	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}\stubpath = "C:\\Windows\\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe"	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}	{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}\stubpath = "C:\\Windows\\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}.exe"	{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}\stubpath = "C:\\Windows\\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe"	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}\stubpath = "C:\\Windows\\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe"	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{846F1EC6-C820-4ed0-ABBF-44008125E859}	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{846F1EC6-C820-4ed0-ABBF-44008125E859}\stubpath = "C:\\Windows\\{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe"	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A461564-DBE4-4650-9AD8-40D89D88B27D}	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}\stubpath = "C:\\Windows\\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe"	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C038EDE5-5B27-4066-905E-BA37B8782B2E}	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}\stubpath = "C:\\Windows\\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe"	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FB9CE19-4783-49ed-986B-A7A4B7265512}	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FB9CE19-4783-49ed-986B-A7A4B7265512}\stubpath = "C:\\Windows\\{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe"	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}\stubpath = "C:\\Windows\\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe"	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}\stubpath = "C:\\Windows\\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe"	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe

Executes dropped EXE 12 IoCs

pid	Process
3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe
5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe
5672	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
3640	{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe
936	{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
File created	C:\Windows\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
File created	C:\Windows\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
File created	C:\Windows\{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
File created	C:\Windows\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
File created	C:\Windows\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
File created	C:\Windows\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
File created	C:\Windows\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe
File created	C:\Windows\{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
File created	C:\Windows\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}.exe	{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe
File created	C:\Windows\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe
File created	C:\Windows\{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
Token: SeIncBasePriorityPrivilege	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
Token: SeIncBasePriorityPrivilege	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe
Token: SeIncBasePriorityPrivilege	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
Token: SeIncBasePriorityPrivilege	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
Token: SeIncBasePriorityPrivilege	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
Token: SeIncBasePriorityPrivilege	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
Token: SeIncBasePriorityPrivilege	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
Token: SeIncBasePriorityPrivilege	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe
Token: SeIncBasePriorityPrivilege	5672	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
Token: SeIncBasePriorityPrivilege	3640	{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3964	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe	91
PID 2720 wrote to memory of 3964	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe	91
PID 2720 wrote to memory of 3964	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe	91
PID 2720 wrote to memory of 5168	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe	92
PID 2720 wrote to memory of 5168	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe	92
PID 2720 wrote to memory of 5168	2720	b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe	92
PID 3964 wrote to memory of 1880	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	93
PID 3964 wrote to memory of 1880	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	93
PID 3964 wrote to memory of 1880	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	93
PID 3964 wrote to memory of 3612	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	94
PID 3964 wrote to memory of 3612	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	94
PID 3964 wrote to memory of 3612	3964	{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe	94
PID 1880 wrote to memory of 2836	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	98
PID 1880 wrote to memory of 2836	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	98
PID 1880 wrote to memory of 2836	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	98
PID 1880 wrote to memory of 4784	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	99
PID 1880 wrote to memory of 4784	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	99
PID 1880 wrote to memory of 4784	1880	{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe	99
PID 2836 wrote to memory of 5388	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	100
PID 2836 wrote to memory of 5388	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	100
PID 2836 wrote to memory of 5388	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	100
PID 2836 wrote to memory of 5500	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	101
PID 2836 wrote to memory of 5500	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	101
PID 2836 wrote to memory of 5500	2836	{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe	101
PID 5388 wrote to memory of 2408	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	102
PID 5388 wrote to memory of 2408	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	102
PID 5388 wrote to memory of 2408	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	102
PID 5388 wrote to memory of 5396	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	103
PID 5388 wrote to memory of 5396	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	103
PID 5388 wrote to memory of 5396	5388	{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe	103
PID 2408 wrote to memory of 4968	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	104
PID 2408 wrote to memory of 4968	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	104
PID 2408 wrote to memory of 4968	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	104
PID 2408 wrote to memory of 1260	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	105
PID 2408 wrote to memory of 1260	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	105
PID 2408 wrote to memory of 1260	2408	{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe	105
PID 4968 wrote to memory of 2184	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	106
PID 4968 wrote to memory of 2184	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	106
PID 4968 wrote to memory of 2184	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	106
PID 4968 wrote to memory of 3692	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	107
PID 4968 wrote to memory of 3692	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	107
PID 4968 wrote to memory of 3692	4968	{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe	107
PID 2184 wrote to memory of 5480	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	108
PID 2184 wrote to memory of 5480	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	108
PID 2184 wrote to memory of 5480	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	108
PID 2184 wrote to memory of 3952	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	109
PID 2184 wrote to memory of 3952	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	109
PID 2184 wrote to memory of 3952	2184	{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe	109
PID 5480 wrote to memory of 4212	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	110
PID 5480 wrote to memory of 4212	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	110
PID 5480 wrote to memory of 4212	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	110
PID 5480 wrote to memory of 4768	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	111
PID 5480 wrote to memory of 4768	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	111
PID 5480 wrote to memory of 4768	5480	{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe	111
PID 4212 wrote to memory of 5672	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	112
PID 4212 wrote to memory of 5672	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	112
PID 4212 wrote to memory of 5672	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	112
PID 4212 wrote to memory of 2128	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	113
PID 4212 wrote to memory of 2128	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	113
PID 4212 wrote to memory of 2128	4212	{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe	113
PID 5672 wrote to memory of 3640	5672	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe	114
PID 5672 wrote to memory of 3640	5672	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe	114
PID 5672 wrote to memory of 3640	5672	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe	114
PID 5672 wrote to memory of 4916	5672	{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe	115

C:\Users\Admin\AppData\Local\Temp\b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b47adbbba7eda6e9b8eb04c12f6d86c0_NeikiAnalytics.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
  C:\Windows\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
    C:\Windows\{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe
      C:\Windows\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
        
        C:\Windows\{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5388
      - C:\Windows\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
        
        C:\Windows\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
        
        C:\Windows\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
        
        C:\Windows\{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
        
        C:\Windows\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5480
        
        C:\Windows\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe
        
        C:\Windows\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
        
        C:\Windows\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Windows\{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe
        
        C:\Windows\{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
        
        C:\Windows\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}.exe
        
        C:\Windows\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}.exe
        13⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C038E~1.EXE > nul
        13⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18242~1.EXE > nul
        12⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DA00D~1.EXE > nul
        11⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EBA43~1.EXE > nul
        10⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{846F1~1.EXE > nul
        9⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{99242~1.EXE > nul
        8⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89EB8~1.EXE > nul
        7⤵
        
        PID:1260
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3A461~1.EXE > nul
        6⤵
        
        PID:5396
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1BA4C~1.EXE > nul
        5⤵
        
        PID:5500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3FB9C~1.EXE > nul
      4⤵
      PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DA2D1~1.EXE > nul
    3⤵
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B47ADB~1.EXE > nul
  2⤵
  PID:5168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{18242B0C-6C1B-47f7-A527-F6E288E36FF5}.exe

Filesize
64KB

MD5
5e28750780fff39d7c7858b5c8c2df16

SHA1
20f82d781e75164b8fa1742ed581d6522f8ef477

SHA256
40fce5f8b385141b1c7495dddbf3778d9e11a6f3bd4be74123b00cc0bec9993f

SHA512
3c4922b8e364b38dee62bd945eeb546ff9fd0e7e045e9e111ad8a8da7c152d1d82d65b2888266ba49723959fee25f78185aafebc022af68d2f32f9db44337b5a

Download Submit
C:\Windows\{1BA4CE38-09A6-4cfe-AF2D-9C09589BC1A4}.exe

Filesize
64KB

MD5
50720ecf599ffdc3cc0b99df756014f8

SHA1
2746d64b1dae0dbda605cd0e69d5e487c72db7f3

SHA256
c86fa73ec66736fe4133d6a3a736d5fd15123ecb5af48d41863ef2ebd8561d97

SHA512
94270da852fd9fe54a41e62d57e19366dd95b13d536472c27122c95e6a72957ffdd64b6ac207fa6fad10d86ccb855355032a9fba61794494956c488effd4f962

Download Submit
C:\Windows\{2FBA0979-E96B-4c64-AB0B-1A5BBB014B5C}.exe

Filesize
64KB

MD5
6e8d565bfb4c91a8ccdf71f7ed5ba479

SHA1
c9886837c28ecb7915660492b30be6e69ca3b4bf

SHA256
ef113e6f68c5aefd2e24180ddc028bea812bf0c4653a840ca42ce66e4486bd00

SHA512
55c9679aa882e2020baf4cc679a74f95623da17c310bf422589cc5ebdf7b142ecb6217a55ed206f50101df1a1b16ec0d43b4ff340be81d23b00431decdfba51c

Download Submit
C:\Windows\{3A461564-DBE4-4650-9AD8-40D89D88B27D}.exe

Filesize
64KB

MD5
4ccfc8073290b11e9a7b6a764b660434

SHA1
6f068b17d51359287a90e795bb6c73395b97ee69

SHA256
bf81634f4c7c8ae701a20112e5c330263b6bf8b7e6a354c353c2e83888a01a9a

SHA512
7a93b7177686e9380c99e848544ec233e1a43435b0a0862a35d80bf778df91b22fb4c69724613975b77ac3381d7708969edcdf1807527fd0b2ad4fdd7c524ffd

Download Submit
C:\Windows\{3FB9CE19-4783-49ed-986B-A7A4B7265512}.exe

Filesize
64KB

MD5
0d922efe58e08b269d1fa20fe1f87880

SHA1
98f6abd3e96182a1e2240c509fe94e739a331f1d

SHA256
0232617cfed250c196cd79c3462f0bc609887cc98d6104383db654690ff2f890

SHA512
cc50f2d083ffeaba6a617ec8afeb3a2d7191a9dad32e7c73ecc91b475925ac2d18f13912599df5d38097de163dddd15912ee880eccc40c84f05e0c79e4bd0c27

Download Submit
C:\Windows\{846F1EC6-C820-4ed0-ABBF-44008125E859}.exe

Filesize
64KB

MD5
c4d0d06a6f9cc219086d9cc1b016b33f

SHA1
c96667c4d2f4c5143446f096e072302c56d3c695

SHA256
02d939b085f4a1952d44fac10f4eb7453159e65ff1929408af35b20ab50ca1a1

SHA512
f20d63e1591ee915009c95be9b5913bb899d6831790b67f700f3b5df7be0626dd82a578c97e5195c6e54fe0e568f8218346d27cffc16286ffbb546a14a96c778

Download Submit
C:\Windows\{89EB8516-AE4F-4b26-B1EE-E1E012BA1A81}.exe

Filesize
64KB

MD5
2422b5d1fbcb77afd8d4b2b71051b4dc

SHA1
6b59bb9330f5f2c826369d7b79dd73072d14b2de

SHA256
59713b2af46a676e3d66957b52868d2ebf33b474335a030468323b76dce67808

SHA512
085338675a43f0fb4ae2eee81b63e4719249cac67faa8fe76ae59df2a0672c334d501970fff42a918525f677851093ffc7556eba82392c886c570762e33f9023

Download Submit
C:\Windows\{99242B23-75D1-4f3e-8991-B0FB0EC8AE86}.exe

Filesize
64KB

MD5
12121a7cca58e039109af719b1b6d079

SHA1
c33b78240d4788e098ae201ee46cdb5c1bafafef

SHA256
a9af050229b6db917c2a3a0d95d79d5d6fab955d5244d27033c58623b547ccf8

SHA512
e38400180bdd858505af84aeca932838966a6e665b9cc7c021469626dd1e1fbff36d47d5f5e8f7974f0308a2faccae8ef5aa6415d5f5e6487e905dc2dafbeb1b

Download Submit
C:\Windows\{C038EDE5-5B27-4066-905E-BA37B8782B2E}.exe

Filesize
64KB

MD5
7f40e6057a60f6446dd3e153dc1267fa

SHA1
58e53c222f0d6bb4bedb958b802321ee8ab4e1e3

SHA256
0f76128be7142192dcb0773ba1b0b2dbb06f06029beb0c6f90fdbbff95ba457b

SHA512
48e56ba167b07be0b16fa2247d5b4d938005d0f8effe314f767289dd7ea7e72fc72f88ca1759ce69a15c3f8bc66ed663547bbb730cf431912b098e3a0c1a3158

Download Submit
C:\Windows\{DA00D9D9-71FE-48b7-863E-18CCE9447ACB}.exe

Filesize
64KB

MD5
38acb231708ac738fb4aceedd9618d35

SHA1
068ec1120a7221cd2a7d6dc2f32a7d403438579b

SHA256
c7b89d7444d372b619ddf3f5d4ce0d7d8b69122b1504368421712bc5f8f7f6ed

SHA512
c1f58bd16cd0232cea1dc28a6445537020e4a987c8659def0c98b46654e9621634b2ee01c47002ea5b3d82ca32ca20a718db6a8daff861092799a25468c26005

Download Submit
C:\Windows\{DA2D15BE-79CB-4cd1-A1A1-5F58307A4F25}.exe

Filesize
64KB

MD5
97b6fc0a8bf8f7d93945073d43316f18

SHA1
75ea1d2afcca2d1f23c232519082687766e51611

SHA256
6346b808300aef1e295c95722c765befc69838ae7f022470e7379ecf911afbf7

SHA512
5738b3b20e89a689d75bc751128c55c9df084b5544d8fd05f4219549d49f318a4a8770e6cb3569a56e610aa5139734bb7723b2141af41100f28ab42fde23d22e

Download Submit
C:\Windows\{EBA43F24-9B2B-4f96-9622-172F799EDB0C}.exe

Filesize
64KB

MD5
9cc5e6da38c860e0762620d11defdef4

SHA1
bff9507bf7fa6ad77f27727012200b459d6519c8

SHA256
e3c5741d6ab768ca575e6ab0713271ed1406cde738f9992297248a0adf77e443

SHA512
0f7ee4c103c0b7b85e4852dbf933f1897f11c429a77adfc74e1dd8270aafa9c27f1722bbdb749be32301270c8945a6466f01b8d858701204f40bad13d3014aab

Download Submit
memory/936-72-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1880-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1880-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2184-46-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2184-41-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2408-34-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2408-29-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2720-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2720-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2836-18-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2836-22-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3640-70-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3640-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3964-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3964-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4212-54-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4212-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4968-39-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4968-35-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5388-27-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5388-24-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5480-51-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5480-47-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5672-60-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5672-64-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads