Malware Analysis Report

2024-11-15 05:49

Sample ID 240514-f4byvscf86
Target 857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics
SHA256 ba26bbdfefe435d7ccf3bed77eeacdb9078a87468bce53916a05e6ed62091d77
Tags
dcrat evasion execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba26bbdfefe435d7ccf3bed77eeacdb9078a87468bce53916a05e6ed62091d77

Threat Level: Known bad

The file 857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

dcrat evasion execution infostealer rat trojan

Dcrat family

DcRat

DCRat payload

UAC bypass

Process spawned unexpected child process

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

System policy modification

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-14 05:25

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 05:25

Reported

2024-05-14 05:27

Platform

win7-20240221-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\f152bbed07f526 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\RCXAC50.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\RCXAC61.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\it-IT\RCXA4AC.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\it-IT\RCXA52A.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\it-IT\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\it-IT\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\it-IT\f152bbed07f526 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
N/A N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 596 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2904 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2904 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 784 wrote to memory of 2588 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 784 wrote to memory of 2588 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 784 wrote to memory of 2588 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 784 wrote to memory of 2164 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 784 wrote to memory of 2164 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 784 wrote to memory of 2164 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2588 wrote to memory of 436 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2588 wrote to memory of 436 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2588 wrote to memory of 436 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 436 wrote to memory of 2808 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 2808 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 2808 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 1960 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 1960 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 1960 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2808 wrote to memory of 2948 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2808 wrote to memory of 2948 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2808 wrote to memory of 2948 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe
PID 2948 wrote to memory of 944 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2948 wrote to memory of 944 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2948 wrote to memory of 944 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2948 wrote to memory of 3008 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2948 wrote to memory of 3008 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 2948 wrote to memory of 3008 N/A C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe C:\Windows\System32\WScript.exe
PID 944 wrote to memory of 1348 N/A C:\Windows\System32\WScript.exe C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics8" /sc MINUTE /mo 9 /tr "'C:\Windows\it-IT\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Windows\it-IT\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics8" /sc MINUTE /mo 8 /tr "'C:\Windows\it-IT\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics8" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics8" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

"C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ba83656-d12f-4f89-916d-15242e1c09fa.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d2de0ec-336c-4417-be36-975c01f98375.vbs"

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8183a161-d181-4e1e-8579-30fcc550ae17.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dde5a6f7-1060-4b33-8610-a623bd6d932d.vbs"

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76526ae5-a288-45b6-92bd-ca80efa389f3.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73543e1e-e29b-4e60-b64e-23182db324ae.vbs"

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a6b5df9-73d8-42d8-8823-557bb8097d02.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb8584f1-d6b6-4443-b82a-a7feafc25815.vbs"

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\dwm.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30081e1a-09b9-43b8-8b67-e4ffcf574cb3.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\303c278f-9933-4efa-9b7e-a2dd17928cd5.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/2904-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

memory/2904-1-0x0000000000F60000-0x000000000129C000-memory.dmp

memory/2904-2-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

memory/2904-3-0x00000000001C0000-0x00000000001CE000-memory.dmp

memory/2904-4-0x00000000003D0000-0x00000000003DE000-memory.dmp

memory/2904-5-0x00000000003E0000-0x00000000003E8000-memory.dmp

memory/2904-6-0x00000000003F0000-0x000000000040C000-memory.dmp

memory/2904-7-0x0000000000410000-0x0000000000418000-memory.dmp

memory/2904-8-0x0000000000420000-0x0000000000430000-memory.dmp

memory/2904-10-0x00000000004B0000-0x00000000004B8000-memory.dmp

memory/2904-9-0x0000000000640000-0x0000000000656000-memory.dmp

memory/2904-11-0x0000000000680000-0x0000000000690000-memory.dmp

memory/2904-12-0x0000000000660000-0x000000000066A000-memory.dmp

memory/2904-13-0x0000000000AF0000-0x0000000000B46000-memory.dmp

memory/2904-14-0x0000000000670000-0x000000000067C000-memory.dmp

memory/2904-15-0x0000000000690000-0x0000000000698000-memory.dmp

memory/2904-16-0x00000000006A0000-0x00000000006AC000-memory.dmp

memory/2904-17-0x00000000006B0000-0x00000000006B8000-memory.dmp

memory/2904-18-0x0000000000B40000-0x0000000000B52000-memory.dmp

memory/2904-19-0x0000000000B70000-0x0000000000B7C000-memory.dmp

memory/2904-20-0x0000000000B80000-0x0000000000B8C000-memory.dmp

memory/2904-21-0x0000000000B90000-0x0000000000B9C000-memory.dmp

memory/2904-22-0x0000000000C20000-0x0000000000C2C000-memory.dmp

memory/2904-23-0x0000000000C30000-0x0000000000C38000-memory.dmp

memory/2904-24-0x0000000000C40000-0x0000000000C4A000-memory.dmp

memory/2904-25-0x0000000000C50000-0x0000000000C5E000-memory.dmp

memory/2904-26-0x0000000000C60000-0x0000000000C68000-memory.dmp

memory/2904-27-0x0000000000C70000-0x0000000000C7E000-memory.dmp

memory/2904-28-0x0000000000C80000-0x0000000000C8C000-memory.dmp

memory/2904-29-0x0000000000C90000-0x0000000000C98000-memory.dmp

memory/2904-30-0x0000000000D20000-0x0000000000D2A000-memory.dmp

memory/2904-32-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

memory/2904-31-0x0000000000D30000-0x0000000000D3C000-memory.dmp

C:\Program Files\Mozilla Firefox\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe

MD5 857ee271fe97719273d3a7df9586c7b0
SHA1 a815a6730abd1044c011e71a142e7d2aa370ba81
SHA256 ba26bbdfefe435d7ccf3bed77eeacdb9078a87468bce53916a05e6ed62091d77
SHA512 1bc69d4932d44fcaff533257d9b0ffca80714ec766bd676052d84a2b0e3ae2d71fbb936420d2a243d288a3ee468e9f41667a192ccd4ebd846e7595dbcfea0186

C:\Windows\it-IT\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe

MD5 18e8e8a4bfa52b6c17f325dac752e749
SHA1 55a46737e5861a159a2b8fe86699301a13bc6fe9
SHA256 6f88202002f9b3da982358b5a816250c189f6539ee986e8c6dbd1834bcc57b86
SHA512 4e3b5d4d778e849f0d7488bb8f5e3ee0dcb453bdc02ae80abee58832d5f91570eaedac306d632bb3a5b02817aef10192134fd25f6df8b6013cadb8048bd6fe2e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 68358a40558030737fa4da427a622a9b
SHA1 437dd3419c0857abd7ca35638f56064d4a0f0265
SHA256 af01e205540fd58b868b502e8abfd9454ebb45e29d6da558711f63651016e416
SHA512 7bb10fbdcedeb863514feca8c984c808b3d7e4ea1f26c9f435e333500cb0b55a0233a5e2df556b2cc989c01e2102dded765f1735e7941400f7ffe875cbaf3792

memory/2280-133-0x000000001B250000-0x000000001B532000-memory.dmp

memory/784-143-0x00000000010C0000-0x00000000013FC000-memory.dmp

memory/2820-132-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

memory/2904-174-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4ba83656-d12f-4f89-916d-15242e1c09fa.vbs

MD5 fb2a80e7b7c83d87b3181d9fc5d9c793
SHA1 50c3271cde25d5faad4422cfb0e9063be8572ede
SHA256 22a63e097c57ce9b4ac33c120b83615d6b79ef9f9f74328ece04427f1c9f3842
SHA512 a7b592def6d66fc0668e6e3f1ece73ba4c22d90ae5c9afd0ebd2c86675a35a6d56e280daf3e2dc73f92ab513d6adaa6aca9845486de3473d055da34a48dc4a21

C:\Users\Admin\AppData\Local\Temp\2d2de0ec-336c-4417-be36-975c01f98375.vbs

MD5 b8a44a700a807942fdd0b7d7007281b3
SHA1 217d970ece8d9492784e7bff22cff68aef56813a
SHA256 f40b86e35c085a21bffc410f07907620b64faa904cb70937d51850bfef097921
SHA512 fcd7f678e058d3ad83472c42b7932166b42c7cd1208475afd80baa391d55e032dfd7be59639d9d54b968d174504c1ad1f95bcb9df71a8c4c640bcb54f0744cf5

C:\Users\Admin\AppData\Local\Temp\8183a161-d181-4e1e-8579-30fcc550ae17.vbs

MD5 241c8397cc593e71bb6a60c2d902bc2b
SHA1 e74b5cb96fc6c5ce9eff60ab03f0981d6183991c
SHA256 152a3dd814220bd88d5ec0f96da8594c2e9159211e7d1a114e687e6bbb56a595
SHA512 0bda382286d43d44215e0ea0ab5d0891dcb54dc0f9bd482f41faa67d9fa752b947dbdde5d3419df8f4219ffbd335fcbc7d87663dd3b216fb6c75129d01b44e78

memory/2948-196-0x0000000000CB0000-0x0000000000D06000-memory.dmp

memory/2948-197-0x0000000000650000-0x0000000000662000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\76526ae5-a288-45b6-92bd-ca80efa389f3.vbs

MD5 a4ece57f95de0cac0da5614b08fed98e
SHA1 6f0129aae9fbbbfaaa81c9e900c4b875339d6781
SHA256 d80a27e001fcff844e4cefa349b5616588562a6a18ad9933a19992af863c09fd
SHA512 62539a9a83d2d74a9ff7841896d2e5e86e213db2fe3d991c2d7854603f8a23dfc07755aa90112824105e736654c21c8646d01152b29b12cbad45cdfed298e799

C:\Users\Admin\AppData\Local\Temp\2a6b5df9-73d8-42d8-8823-557bb8097d02.vbs

MD5 13eb8398ea280a2b6527d03727749577
SHA1 cae7f040045bc207fcc765563d79f9b849f471f2
SHA256 684e12a6039fecc7c7843373900aab598eab1472d989a739f2a6af3be11d3347
SHA512 28fa5faafba064aadf6e1e0c4d5b0c328751fa94c970f6d0eb835bdd4769f432ef6220470dc4f5ad7a09a9f523453e4ae5bddba4e5bbf3fe86c1bae5e837fdae

memory/2024-220-0x0000000001130000-0x000000000146C000-memory.dmp

memory/2024-221-0x00000000010E0000-0x0000000001136000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\30081e1a-09b9-43b8-8b67-e4ffcf574cb3.vbs

MD5 715447dd0bf26df95d96a7b6bd3f7ef4
SHA1 dc1ac461b8adfbf339be251c16498d09475d7abe
SHA256 7a1f4bba94e7f98db374a24250cc3a6673fa558b2970fd874f4e1592305c5dda
SHA512 10a8a368832013a05e24e745ffef7e850156f23e49afda4900101c27ee2ae259925dac65c5d9b2d59a776b11df5cc35d35054d0d1e92919860d935a76cdaed94

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-14 05:25

Reported

2024-05-14 05:27

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\56085415360792 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\RCX4B40.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files\dotnet\shared\wininit.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft\55b276f4edf653 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\shared\RCX4417.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX4116.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX4117.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\RCX4D55.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\5b884080fd4f94 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\shared\wininit.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\en-US\e6c9b481da804f C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\shared\RCX4399.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\RCX48AE.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\RCX48BE.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\RCX4B41.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\RCX4D56.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\IME\IMETC\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\SLS\RCX3CDC.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Offline Web Pages\RCX461B.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Offline Web Pages\RCX4699.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\Offline Web Pages\5b884080fd4f94 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\IME\IMETC\RCX3F01.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\SLS\RCX3CED.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\SoftwareDistribution\SLS\e1ef82546f0b02 C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\IME\IMETC\dllhost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File created C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\IME\IMETC\RCX3F02.tmp C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\IME\IMETC\dllhost.exe C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Windows\Offline Web Pages\fontdrvhost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Offline Web Pages\fontdrvhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3032 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 1704 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3032 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 3032 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 3936 wrote to memory of 2772 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 3936 wrote to memory of 2772 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 3936 wrote to memory of 1760 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 3936 wrote to memory of 1760 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2772 wrote to memory of 4916 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 2772 wrote to memory of 4916 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4916 wrote to memory of 4108 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4916 wrote to memory of 4108 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4916 wrote to memory of 2188 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4916 wrote to memory of 2188 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4108 wrote to memory of 1500 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4108 wrote to memory of 1500 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 1500 wrote to memory of 4760 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 1500 wrote to memory of 4760 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 1500 wrote to memory of 3608 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 1500 wrote to memory of 3608 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4760 wrote to memory of 4908 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4760 wrote to memory of 4908 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4908 wrote to memory of 4336 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4908 wrote to memory of 4336 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4908 wrote to memory of 1952 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4908 wrote to memory of 1952 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4336 wrote to memory of 436 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4336 wrote to memory of 436 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 436 wrote to memory of 844 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 844 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 4160 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 436 wrote to memory of 4160 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 844 wrote to memory of 4352 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 844 wrote to memory of 4352 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4352 wrote to memory of 4152 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4352 wrote to memory of 4152 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4352 wrote to memory of 2856 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4352 wrote to memory of 2856 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4152 wrote to memory of 4556 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4152 wrote to memory of 4556 N/A C:\Windows\System32\WScript.exe C:\Windows\Offline Web Pages\fontdrvhost.exe
PID 4556 wrote to memory of 3324 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4556 wrote to memory of 3324 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4556 wrote to memory of 2900 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4556 wrote to memory of 2900 N/A C:\Windows\Offline Web Pages\fontdrvhost.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Offline Web Pages\fontdrvhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\857ee271fe97719273d3a7df9586c7b0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\SoftwareDistribution\SLS\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\IMETC\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\IMETC\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\lib\ext\explorer.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb146de3-f490-45cb-b8da-3cc43b2b168d.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a40b1f81-bc61-4c34-9e64-f3228d9997c6.vbs"

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6996dda1-fa2e-4f02-86af-bc6947a5e7fd.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af6891dc-0fde-4e47-a6c5-e2f4a342facf.vbs"

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93d53960-2fb3-476d-98e9-ed7c6309ecf8.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11fd0a3c-eeab-4b7c-95ca-91435b96eb2d.vbs"

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39eb1c80-1c3f-49bf-ab0d-0426b4b80b6a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\491e2dc5-b229-45c8-a2c3-33175ac82fd8.vbs"

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5adfa961-521b-4a1b-957b-1b028c305ac3.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a1470ba-11f3-483d-ad67-6b8e9523efdf.vbs"

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\877794ec-c394-488f-9263-a2718a7d7df0.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6eaca409-40fa-452e-a315-3c747ffee63d.vbs"

C:\Windows\Offline Web Pages\fontdrvhost.exe

"C:\Windows\Offline Web Pages\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97a8278b-354d-4548-ae14-2c15b69577a9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0c93835-c5ca-4b76-94c9-43421d76d0f8.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 42.197.8.141.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/3032-0-0x00007FFCAA423000-0x00007FFCAA425000-memory.dmp

memory/3032-1-0x0000000000E20000-0x000000000115C000-memory.dmp

memory/3032-2-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

memory/3032-3-0x0000000003390000-0x000000000339E000-memory.dmp

memory/3032-4-0x00000000033A0000-0x00000000033AE000-memory.dmp

memory/3032-6-0x00000000033C0000-0x00000000033DC000-memory.dmp

memory/3032-5-0x00000000033B0000-0x00000000033B8000-memory.dmp

memory/3032-9-0x00000000033F0000-0x0000000003400000-memory.dmp

memory/3032-8-0x00000000033E0000-0x00000000033E8000-memory.dmp

memory/3032-11-0x0000000003420000-0x0000000003428000-memory.dmp

memory/3032-10-0x0000000003400000-0x0000000003416000-memory.dmp

memory/3032-12-0x0000000003430000-0x0000000003440000-memory.dmp

memory/3032-7-0x000000001C440000-0x000000001C490000-memory.dmp

memory/3032-13-0x0000000003440000-0x000000000344A000-memory.dmp

memory/3032-14-0x000000001C490000-0x000000001C4E6000-memory.dmp

memory/3032-15-0x0000000003450000-0x000000000345C000-memory.dmp

memory/3032-16-0x000000001C4E0000-0x000000001C4E8000-memory.dmp

memory/3032-17-0x000000001C4F0000-0x000000001C4FC000-memory.dmp

memory/3032-18-0x000000001C500000-0x000000001C508000-memory.dmp

memory/3032-19-0x000000001C510000-0x000000001C522000-memory.dmp

memory/3032-20-0x000000001CA70000-0x000000001CF98000-memory.dmp

memory/3032-21-0x000000001C540000-0x000000001C54C000-memory.dmp

memory/3032-22-0x000000001C550000-0x000000001C55C000-memory.dmp

memory/3032-23-0x000000001C560000-0x000000001C56C000-memory.dmp

memory/3032-24-0x000000001C570000-0x000000001C57C000-memory.dmp

memory/3032-29-0x000000001C7C0000-0x000000001C7CE000-memory.dmp

memory/3032-30-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

memory/3032-32-0x000000001C830000-0x000000001C83A000-memory.dmp

memory/3032-33-0x000000001C840000-0x000000001C84C000-memory.dmp

memory/3032-34-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

memory/3032-31-0x000000001C820000-0x000000001C828000-memory.dmp

memory/3032-28-0x000000001C7B0000-0x000000001C7B8000-memory.dmp

memory/3032-27-0x000000001C6A0000-0x000000001C6AE000-memory.dmp

memory/3032-26-0x000000001C690000-0x000000001C69A000-memory.dmp

memory/3032-25-0x000000001C680000-0x000000001C688000-memory.dmp

memory/3032-37-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

C:\Windows\Offline Web Pages\fontdrvhost.exe

MD5 857ee271fe97719273d3a7df9586c7b0
SHA1 a815a6730abd1044c011e71a142e7d2aa370ba81
SHA256 ba26bbdfefe435d7ccf3bed77eeacdb9078a87468bce53916a05e6ed62091d77
SHA512 1bc69d4932d44fcaff533257d9b0ffca80714ec766bd676052d84a2b0e3ae2d71fbb936420d2a243d288a3ee468e9f41667a192ccd4ebd846e7595dbcfea0186

C:\Program Files\dotnet\shared\wininit.exe

MD5 cabcdf952989b1dcf1b586df3edbc36d
SHA1 5c8ac76273f3b1a08c4489b82719c7fdf03f24cd
SHA256 8fd73e3ddbcf491d5420e7de32c35823f6b2b81705c4cdb0766616c862fcff70
SHA512 906405863779c66e38b365ce0bd1c942c5a482c19c32cad11ca391bdc444f0b1fcc0b456d26e958dc50ffd730dc52654e0378f9f090d9688524979cd07d51271

C:\Windows\Offline Web Pages\fontdrvhost.exe

MD5 2bd5876b597219f632c54705251c99a2
SHA1 90f6f22512e2297f43eb8104d492bf54f66d8a69
SHA256 52ab03f6941c21fb953f011d4f3de15c92fc566229ce42b1b2b1672c85683d6d
SHA512 ade4bff02bc00fbb137e9a450b612583685c9ffffaa222d4b48d98568fe76fedfa7d7a7201aa9630b70a02dc8ce106b5fc81be6dcd7ed4bbd46e5f51961d2881

memory/4656-190-0x000002D99DD90000-0x000002D99DDB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1rmqi2u.4jw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3032-296-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

memory/3936-297-0x0000000000630000-0x000000000096C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

memory/3936-321-0x000000001B6A0000-0x000000001B6F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fb146de3-f490-45cb-b8da-3cc43b2b168d.vbs

MD5 b8aa3a30aa85ea689e75a1a5219ca0e7
SHA1 1b5309a9db78991d794295fc94ffb04ba1fce683
SHA256 3276b9eac3291f16ee8845e6b7612a48aac2362a990ffc2a482a46b3dc860d14
SHA512 ea0e30b6ce6168a1829a964110941c096f1c703c0e8de7a9165769c9942ec2b330b0621b79cd084a9d2629ec7f66a0414604eb659ab307bf80d6b43511f41516

C:\Users\Admin\AppData\Local\Temp\a40b1f81-bc61-4c34-9e64-f3228d9997c6.vbs

MD5 4f7b81c12ab5a7a3f26633c268149aa5
SHA1 7ae140e9d9c3184aaf64a2925891b20b1306ad19
SHA256 b3b55938d085ed03e82c620d6eba6764a02be786e79264d7ebd546563ec7febb
SHA512 02b1fddc637fedeb8cd85a485191b742414f03791dd9cbec8088c25694b915bff4be468a720c8ddba1884040357b774fe02a8cfff378a5448bed5e5b662c4ffb

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

C:\Users\Admin\AppData\Local\Temp\6996dda1-fa2e-4f02-86af-bc6947a5e7fd.vbs

MD5 4b4b888228078efe9c1117b2e797bd0a
SHA1 f219e9c2546f551c34272756a8d6cc5548f7eb44
SHA256 f1b39bcd210df30160a30febb9baa27c614baa8d539cec66f0bf80616551d778
SHA512 3dffb50e88e6c2d2a5fb12976d7ac5d3a41c649ef0341c92dc71664a50c4f6bc2fa4b02d5db5d02b860b9934d5f8818b2f7fbcbabc8d1472e2487571ca89da3b

C:\Users\Admin\AppData\Local\Temp\93d53960-2fb3-476d-98e9-ed7c6309ecf8.vbs

MD5 f9afc1708a1c9cc03292fae89514d39a
SHA1 3479a0ee9571ae2d88e71f8728ae564014a114e4
SHA256 46d1aa129237b641ee2cca72791ef77163291594c944c8b42af4103e204845f6
SHA512 c6c53f60ce4e429df63ee115ce7444f0052b6868790a19089132941a4451688dafc818df34bbe7e63d708d161e78c10f65463ff25bfa569387d8f1a9daf430f1

C:\Users\Admin\AppData\Local\Temp\39eb1c80-1c3f-49bf-ab0d-0426b4b80b6a.vbs

MD5 10ad04f438918aa61f8d68d813d239e4
SHA1 a6e2c1022e306db266293684fb11a984371ce5c5
SHA256 c14dde9a2502239511087c3d84c307a36c933c988f732cf01bd3e8be3dd5ce9e
SHA512 ffa145cff80336323a7699c2239bb71561965ffd9dd933781a8f9c989d282c7c981e493fa05e8b4ace33ab5fad4db0920feb685daf7af636cea06ed68acb45b3

C:\Users\Admin\AppData\Local\Temp\5adfa961-521b-4a1b-957b-1b028c305ac3.vbs

MD5 500d969219a1b78b46ccf71efb4a9ae5
SHA1 3b5ff74cfee5e0a2b49bf946245d1176a955db2b
SHA256 7f5071aa438514db1dc7909e5f75326b7785ad12a2465dea0e48180600f476da
SHA512 c4576df0f318015b353ddf506365494b84d2441f67592f934c5753df7ad893d9973a6401904acf123ce8d2606907b7eccacbb4df873b2c6778675c79cb7904f7

C:\Users\Admin\AppData\Local\Temp\877794ec-c394-488f-9263-a2718a7d7df0.vbs

MD5 7d102d6e9348f2f8af743b6c14528db4
SHA1 9aefe7bd690927d98c464fe2b3ad16fb7d2dd5cd
SHA256 20e866fc6192f2c3bcd7c8a571a40c45cc56766906858116813da2aa72991868
SHA512 be07d352d6fcf33ff5429e18149db86ef69a5e5a7eaae30620275222dc6f393dd15151bdaeab7fa3fe092590b0fee4dab471a145ad3b9a6766306e5408ceb592

C:\Users\Admin\AppData\Local\Temp\97a8278b-354d-4548-ae14-2c15b69577a9.vbs

MD5 9bf8190e99968221f24843cce7b37bc4
SHA1 dd382136e22b9eba85f71f262e6a641579553faf
SHA256 f3e8ec0b04804add0e8a0055592d90196a460bfe8c4dfcf947ee0366f624a60f
SHA512 14b23af230b1848f4e7c961f6ea4eac3641b16420070199c051d5afc6dce36b4882be418a817fb2d5cf563d06e208bd9ab55ed621630c3dc81fd142092a4005f