Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 02:40
Behavioral task
behavioral1
Sample
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe
-
Size
952KB
-
MD5
5c8aee7bbd1b09e31178be12bc847c30
-
SHA1
5cc34074f6c74cb0cbb3d282e9360a2d2eace451
-
SHA256
e97d9651c1df50e5eb6847b6dde990e9fab3504c245557b61df65215df6de176
-
SHA512
199f60f46d89bf3aadac7e2c67dbcdae716e3644b2db0c67e340cd55b47c78a1683acf27021850755d5ab66ee6850d3eba425e369604413b9897eb01f176ec2b
-
SSDEEP
24576:W+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:x8/KfRTK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 7 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\", \"C:\\Windows\\System32\\w32tm\\taskhost.exe\", \"C:\\Windows\\System32\\mfc120fra\\lsm.exe\", \"C:\\Windows\\System32\\mfc110kor\\winlogon.exe\", \"C:\\Windows\\System32\\mfc140esn\\winlogon.exe\", \"C:\\Windows\\System32\\ieUnatt\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\dllhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\", \"C:\\Windows\\System32\\w32tm\\taskhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\", \"C:\\Windows\\System32\\w32tm\\taskhost.exe\", \"C:\\Windows\\System32\\mfc120fra\\lsm.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\", \"C:\\Windows\\System32\\w32tm\\taskhost.exe\", \"C:\\Windows\\System32\\mfc120fra\\lsm.exe\", \"C:\\Windows\\System32\\mfc110kor\\winlogon.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\", \"C:\\Windows\\System32\\w32tm\\taskhost.exe\", \"C:\\Windows\\System32\\mfc120fra\\lsm.exe\", \"C:\\Windows\\System32\\mfc110kor\\winlogon.exe\", \"C:\\Windows\\System32\\mfc140esn\\winlogon.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\", \"C:\\Windows\\System32\\w32tm\\taskhost.exe\", \"C:\\Windows\\System32\\mfc120fra\\lsm.exe\", \"C:\\Windows\\System32\\mfc110kor\\winlogon.exe\", \"C:\\Windows\\System32\\mfc140esn\\winlogon.exe\", \"C:\\Windows\\System32\\ieUnatt\\sppsvc.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2544 2640 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2572 2640 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2748 2640 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2524 2640 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 2640 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2984 2640 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 2640 schtasks.exe -
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exetaskhost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2196-1-0x0000000000D40000-0x0000000000E34000-memory.dmp dcrat C:\Windows\System32\mfc140esn\winlogon.exe dcrat C:\Windows\System32\mfc120fra\lsm.exe dcrat C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe dcrat behavioral1/memory/1856-119-0x0000000000DA0000-0x0000000000E94000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
taskhost.exepid process 1856 taskhost.exe -
Adds Run key to start application 2 TTPs 14 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\w32tm\\taskhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc110kor\\winlogon.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc110kor\\winlogon.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc140esn\\winlogon.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\System32\\w32tm\\taskhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Recovery\\5b7985c2-d100-11ee-bb00-c695cbc44580\\taskhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\mfc120fra\\lsm.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\dllhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0117-0409-0000-0000000FF1CE}-C\\Access.en-us\\dllhost.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\System32\\mfc120fra\\lsm.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc140esn\\winlogon.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\ieUnatt\\sppsvc.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\ieUnatt\\sppsvc.exe\"" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Processes:
taskhost.exe5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Drops file in System32 directory 25 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exedescription ioc process File created C:\Windows\System32\ieUnatt\sppsvc.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\ieUnatt\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc120fra\RCX3D27.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\ieUnatt\sppsvc.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\mfc110kor\winlogon.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc110kor\winlogon.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\mfc120fra\101b941d020240259ca4912829b53995ad543df6 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\w32tm\b75386f1303e64d8139363b71e44ac16341adf4e 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\w32tm\RCX3AB4.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc110kor\RCX3F3A.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\w32tm\taskhost.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\mfc140esn\cc11b995f2a76da408ea6a601e682e64743153ad 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\w32tm\taskhost.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc120fra\RCX3CB8.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\w32tm\RCX3AB5.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc140esn\winlogon.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\ieUnatt\RCX4344.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc140esn\RCX413F.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\mfc140esn\winlogon.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc140esn\RCX4140.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\ieUnatt\RCX4345.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\mfc110kor\cc11b995f2a76da408ea6a601e682e64743153ad 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc120fra\lsm.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File opened for modification C:\Windows\System32\mfc110kor\RCX3F3B.tmp 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe File created C:\Windows\System32\mfc120fra\lsm.exe 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2432 schtasks.exe 2984 schtasks.exe 1056 schtasks.exe 2544 schtasks.exe 2572 schtasks.exe 2748 schtasks.exe 2524 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exepid process 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exetaskhost.exedescription pid process Token: SeDebugPrivilege 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Token: SeDebugPrivilege 1856 taskhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exedescription pid process target process PID 2196 wrote to memory of 1856 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe taskhost.exe PID 2196 wrote to memory of 1856 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe taskhost.exe PID 2196 wrote to memory of 1856 2196 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe taskhost.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exetaskhost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5c8aee7bbd1b09e31178be12bc847c30_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2196 -
C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\taskhost.exe"C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\taskhost.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1856
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\w32tm\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\mfc120fra\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\mfc110kor\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\mfc140esn\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\ieUnatt\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD539502141a6598bb1fa71d5a0e6de504d
SHA167e1947e0bca927ad2f9c709d6777f0adc277199
SHA2569aa56a80084cc26e2a3669bde92dcde0ac3e0308de473b2f1db10679beb05c64
SHA5128eea5032ac7f7fee62879ee9e0e17bfcbf51626b2a87b621009bc8654246083383aaa7ec2c1b793ebc8a5b76842c10459c14d1916e84aba9e508a4542c41a2a8
-
Filesize
952KB
MD5c6829961b8b15e4e72a427292dc1ca03
SHA1b0b49297d0d2147d48e8c00ef8322db4b06489a4
SHA256050ad1735814338e79e711ca13e66430a109167821f04dd31b916c701b9163e0
SHA5125b74543ae0245370bc89c167652630d2a2e264544df4ea6eb7b209cbcc364ccb4e6b2fb773bc113333eeb7783a107b537bb11af3f7526ae1722eae8b1a08f4cd
-
Filesize
952KB
MD55c8aee7bbd1b09e31178be12bc847c30
SHA15cc34074f6c74cb0cbb3d282e9360a2d2eace451
SHA256e97d9651c1df50e5eb6847b6dde990e9fab3504c245557b61df65215df6de176
SHA512199f60f46d89bf3aadac7e2c67dbcdae716e3644b2db0c67e340cd55b47c78a1683acf27021850755d5ab66ee6850d3eba425e369604413b9897eb01f176ec2b