16444da27ad2f1069bcb34852e5a18dbedd12b5340b0c89daf7af6e8687b458b

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe
Size

91KB
MD5

647fdefadee3780d42d5f1b257528810
SHA1

cad812afca09d9eee0b6bda74e966ab33f578939
SHA256

16444da27ad2f1069bcb34852e5a18dbedd12b5340b0c89daf7af6e8687b458b
SHA512

53da5b3bcefee3435b4be1e97ce367a6f7046956121ddda1fa6aa9dc3fbe92fc28d391a3c7b197e7e1333928e3014f723d740a0c03d3a53cc1446809eb8105b6
SSDEEP

768:5vw9816uhKiro/4/wQNNrfrunMxVFA3b7t:lEGkmo/lCunMxVS3Ht

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30E93E31-2535-4c27-8E7F-9924E50E8513}	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{30E93E31-2535-4c27-8E7F-9924E50E8513}\stubpath = "C:\\Windows\\{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe"	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FCFDD22-1173-4c17-A962-435852EDCB43}\stubpath = "C:\\Windows\\{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe"	{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C9DC4F3-C748-47e4-88E2-B90958802775}\stubpath = "C:\\Windows\\{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe"	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}\stubpath = "C:\\Windows\\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe"	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BDCE8CA7-6787-4758-96A7-C3968D014A53}\stubpath = "C:\\Windows\\{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe"	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0990955-E563-43f6-8A1B-114D5E0AE02F}	{D165E198-E475-45a6-A183-E459DA48144A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}	{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}\stubpath = "C:\\Windows\\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe"	{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}\stubpath = "C:\\Windows\\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe"	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BDCE8CA7-6787-4758-96A7-C3968D014A53}	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B0990955-E563-43f6-8A1B-114D5E0AE02F}\stubpath = "C:\\Windows\\{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe"	{D165E198-E475-45a6-A183-E459DA48144A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0508B71F-A694-490f-9714-9B448BBFB767}	{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0508B71F-A694-490f-9714-9B448BBFB767}\stubpath = "C:\\Windows\\{0508B71F-A694-490f-9714-9B448BBFB767}.exe"	{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8C9DC4F3-C748-47e4-88E2-B90958802775}	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}\stubpath = "C:\\Windows\\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe"	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D165E198-E475-45a6-A183-E459DA48144A}	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D165E198-E475-45a6-A183-E459DA48144A}\stubpath = "C:\\Windows\\{D165E198-E475-45a6-A183-E459DA48144A}.exe"	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0FCFDD22-1173-4c17-A962-435852EDCB43}	{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe

Deletes itself 1 IoCs

pid	Process
2144	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe
2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe
2964	{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe
1656	{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
584	{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe
2188	{0508B71F-A694-490f-9714-9B448BBFB767}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
File created	C:\Windows\{D165E198-E475-45a6-A183-E459DA48144A}.exe	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
File created	C:\Windows\{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe	{D165E198-E475-45a6-A183-E459DA48144A}.exe
File created	C:\Windows\{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe
File created	C:\Windows\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
File created	C:\Windows\{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
File created	C:\Windows\{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe	{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
File created	C:\Windows\{0508B71F-A694-490f-9714-9B448BBFB767}.exe	{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe
File created	C:\Windows\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe
File created	C:\Windows\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
File created	C:\Windows\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe	{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe
Token: SeIncBasePriorityPrivilege	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
Token: SeIncBasePriorityPrivilege	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
Token: SeIncBasePriorityPrivilege	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
Token: SeIncBasePriorityPrivilege	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
Token: SeIncBasePriorityPrivilege	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
Token: SeIncBasePriorityPrivilege	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe
Token: SeIncBasePriorityPrivilege	2964	{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe
Token: SeIncBasePriorityPrivilege	1656	{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
Token: SeIncBasePriorityPrivilege	584	{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3036	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 3036	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 3036	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 3036	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	28
PID 2344 wrote to memory of 2144	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 2144	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 2144	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 2144	2344	647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe	29
PID 3036 wrote to memory of 2716	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	30
PID 3036 wrote to memory of 2716	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	30
PID 3036 wrote to memory of 2716	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	30
PID 3036 wrote to memory of 2716	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	30
PID 3036 wrote to memory of 2876	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	31
PID 3036 wrote to memory of 2876	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	31
PID 3036 wrote to memory of 2876	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	31
PID 3036 wrote to memory of 2876	3036	{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe	31
PID 2716 wrote to memory of 2816	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	32
PID 2716 wrote to memory of 2816	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	32
PID 2716 wrote to memory of 2816	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	32
PID 2716 wrote to memory of 2816	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	32
PID 2716 wrote to memory of 2484	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	33
PID 2716 wrote to memory of 2484	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	33
PID 2716 wrote to memory of 2484	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	33
PID 2716 wrote to memory of 2484	2716	{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe	33
PID 2816 wrote to memory of 1268	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	36
PID 2816 wrote to memory of 1268	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	36
PID 2816 wrote to memory of 1268	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	36
PID 2816 wrote to memory of 1268	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	36
PID 2816 wrote to memory of 1908	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	37
PID 2816 wrote to memory of 1908	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	37
PID 2816 wrote to memory of 1908	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	37
PID 2816 wrote to memory of 1908	2816	{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe	37
PID 1268 wrote to memory of 1620	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	38
PID 1268 wrote to memory of 1620	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	38
PID 1268 wrote to memory of 1620	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	38
PID 1268 wrote to memory of 1620	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	38
PID 1268 wrote to memory of 1460	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	39
PID 1268 wrote to memory of 1460	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	39
PID 1268 wrote to memory of 1460	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	39
PID 1268 wrote to memory of 1460	1268	{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe	39
PID 1620 wrote to memory of 772	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	40
PID 1620 wrote to memory of 772	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	40
PID 1620 wrote to memory of 772	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	40
PID 1620 wrote to memory of 772	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	40
PID 1620 wrote to memory of 2736	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	41
PID 1620 wrote to memory of 2736	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	41
PID 1620 wrote to memory of 2736	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	41
PID 1620 wrote to memory of 2736	1620	{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe	41
PID 772 wrote to memory of 1680	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	42
PID 772 wrote to memory of 1680	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	42
PID 772 wrote to memory of 1680	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	42
PID 772 wrote to memory of 1680	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	42
PID 772 wrote to memory of 876	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	43
PID 772 wrote to memory of 876	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	43
PID 772 wrote to memory of 876	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	43
PID 772 wrote to memory of 876	772	{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe	43
PID 1680 wrote to memory of 2964	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	44
PID 1680 wrote to memory of 2964	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	44
PID 1680 wrote to memory of 2964	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	44
PID 1680 wrote to memory of 2964	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	44
PID 1680 wrote to memory of 2852	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	45
PID 1680 wrote to memory of 2852	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	45
PID 1680 wrote to memory of 2852	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	45
PID 1680 wrote to memory of 2852	1680	{D165E198-E475-45a6-A183-E459DA48144A}.exe	45

C:\Users\Admin\AppData\Local\Temp\647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\647fdefadee3780d42d5f1b257528810_NeikiAnalytics.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe
  C:\Windows\{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
    C:\Windows\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
      C:\Windows\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
        
        C:\Windows\{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1268
      - C:\Windows\{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
        
        C:\Windows\{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
        
        C:\Windows\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\{D165E198-E475-45a6-A183-E459DA48144A}.exe
        
        C:\Windows\{D165E198-E475-45a6-A183-E459DA48144A}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe
        
        C:\Windows\{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Windows\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
        
        C:\Windows\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1656
        
        C:\Windows\{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe
        
        C:\Windows\{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:584
        
        C:\Windows\{0508B71F-A694-490f-9714-9B448BBFB767}.exe
        
        C:\Windows\{0508B71F-A694-490f-9714-9B448BBFB767}.exe
        12⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0FCFD~1.EXE > nul
        12⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1FD91~1.EXE > nul
        11⤵
        
        PID:572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B0990~1.EXE > nul
        10⤵
        
        PID:600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D165E~1.EXE > nul
        9⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BBE35~1.EXE > nul
        8⤵
        
        PID:876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30E93~1.EXE > nul
        7⤵
        
        PID:2736
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDCE8~1.EXE > nul
        6⤵
        
        PID:1460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79F4D~1.EXE > nul
        5⤵
        
        PID:1908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{E40B7~1.EXE > nul
      4⤵
      PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8C9DC~1.EXE > nul
    3⤵
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\647FDE~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0508B71F-A694-490f-9714-9B448BBFB767}.exe

Filesize
91KB

MD5
723a677e5200b136b973afcd9e2c7b77

SHA1
bb87b492baa84128754935e6ca26211ae9e5afb7

SHA256
d76ac7ac2d7ed9ef5b57268084d24c73ceaa88ed0ada749882418b5f24571cab

SHA512
bc9fcc4e0e02f8ba0565ac688b1d70bd5860ca29b3f6039eb562375dbc523eae56cbd07e09287c6f4ce03fce969a85ef3fb4723851760f6d8ad2d84fbfaa65ce

Download Submit
C:\Windows\{0FCFDD22-1173-4c17-A962-435852EDCB43}.exe

Filesize
91KB

MD5
f32a0bd8402e1d9e7f177baab6f7638c

SHA1
dc34a0f8eb73f8d6a394400c4508e3635ab73207

SHA256
3c06d5644e27d7f3cc3630ff2b03ab52c9166d4bdf7c4d98a93fb71b7c54b42d

SHA512
dc638ff8714c8e6e745a09cd919ad2b273b02face23ac93bb4f87844914cbeef65042918bfe2557829bda20d2337d6e9cffeb1682aa69056ce774526e6b08bd3

Download Submit
C:\Windows\{1FD9167E-4F7E-447f-B046-E29E1FECD6B8}.exe

Filesize
91KB

MD5
e7cdcaacbda642194160c25fff4f9209

SHA1
2ecf5280e2e43b8b9d25d6a6470cab4e3f72402a

SHA256
4091cc760d3cc61b8884c1b0ead5cf7344712eef6a191bf57ce4a44bc86e9086

SHA512
b0545a4f7b6de7480afd6c7cdf7b292b3790b9d72a9d950d1fb3777895c03482816771b8ce67434c3466509580189fa98cc3ecb647b40bc9aa10a750f2a456ad

Download Submit
C:\Windows\{30E93E31-2535-4c27-8E7F-9924E50E8513}.exe

Filesize
91KB

MD5
a5cc6fffa4f3c73c37a6ec049b301e6a

SHA1
d316edf36394700c8802273e02b896a322ce4454

SHA256
4d382bed9e780807e53270c9b4c39a726fa6521a6142f0e1440c7fac600023b3

SHA512
5eb8e1610f942fd0f4087956c749329f6903303234777b6e6e742273f4634be72d98b6daa71913eb5a54ccac0d88b06b0df9468847cbdd905abfbb7d9153c2de

Download Submit
C:\Windows\{79F4DA4D-CBF3-4bb5-BFDC-350043F75EF4}.exe

Filesize
91KB

MD5
da013bf467924aac7ad86b514eb6d9ea

SHA1
94f4d5715f0dfb4099d92c7739b7819c0f7d03e1

SHA256
313b16b21ed66fc6f826d6e1567bafd67c9ec4a0a6e39bc9a37b4315f2f295ae

SHA512
560c2aaf9e8fe9af3ec96590cdd438fb2e1c44e265b84ab7b7b6bce22b337f65d6fb9a99d2f82985b38dfbd476a4efc614ef8c3c3f81367a4073a7ec81d86a03

Download Submit
C:\Windows\{8C9DC4F3-C748-47e4-88E2-B90958802775}.exe

Filesize
91KB

MD5
e321382acb04e139e6a2283b87382a21

SHA1
58966ae51f7c8faa7f4badd65c63db5e37cc1142

SHA256
b796c7c289aeb3052e4df25374440f4b8f8246d43542312a3f6eb6d85a37f2e8

SHA512
4c345f284232437600354bb65e0aadd0b4d4d4109689f86d070e1af5da3e17552100cc99574254cf40dc49906f70b9e10976ee59936db4afd9194c2d59c52246

Download Submit
C:\Windows\{B0990955-E563-43f6-8A1B-114D5E0AE02F}.exe

Filesize
91KB

MD5
4af44816c5f0f7e10603d5ad828751d2

SHA1
b98c7e78dcd6d9337283790ce46ea00d6860bdcc

SHA256
3cac1bc434dc57732b7b7a07f1a8a951bd1f6531fcda045b35aee968964ad102

SHA512
74eda21d7944b8f751fad5a510ce2ade7dd8b9f9a17215fe9be59702462206b1414238d2067bf7ba9d45b19460f161ee04a10f7ccb84a8beaf92a1079896abbe

Download Submit
C:\Windows\{BBE351C2-E9A2-488f-B183-1EC86DCE2E1F}.exe

Filesize
91KB

MD5
fc47d0194b2426f033aa4cbad1fe16de

SHA1
4c3f7f6f72921c9eef59de362582cd24343bc585

SHA256
8cb8ca98080cb3a165515e3555b6fb1b6928d85720c06fa70f74feb70e284bee

SHA512
00c3c631c97c4323a0b3b369722bce12d6a2a05f6a2c60aeff028d06e8e6d90a3d1819f7d592b71a52ca4fc31920d451d82cba1412aa513573e52341f367643e

Download Submit
C:\Windows\{BDCE8CA7-6787-4758-96A7-C3968D014A53}.exe

Filesize
91KB

MD5
8bf2fee5acc2b69cc81cb337b2a87bb6

SHA1
42e453cf2898cd9805856e3523e83b9bd1969638

SHA256
09f590b6ccf76e16b5b8fc12c8c47327705eaa173d9a39358080cac03b9298e4

SHA512
7141d148828c21eeeb460aa2c6251072269dab692077582a41995ae0ad5f423e43fd677177fd3ee2c8a4462f712e145d1fc017d4adb6dea0169c0e7eafe72c73

Download Submit
C:\Windows\{D165E198-E475-45a6-A183-E459DA48144A}.exe

Filesize
91KB

MD5
cbaccabd4ec840a763c077a854be533b

SHA1
6b2cc6fe7d2edc6c97f0dc4eeadfa7709273df43

SHA256
b1db2326cc382e5f5d6a3f2596ca69383f4b3673ab1f892b823a6cdf60222c4a

SHA512
2938126840da15b9938626cfa2d234e46f0f1881a989cea1d2c98825d8216bfb2c7ce9a46fa6e5f27d50dce3cd6f0197f695904a2ca0ef64dc6644521b4d9bf9

Download Submit
C:\Windows\{E40B74AC-F925-48ec-BDB9-933F8054ED0F}.exe

Filesize
91KB

MD5
305cd313630dd1f4bdc97190c0dca29a

SHA1
b87d65e16779b23f3e6b4164eb92211507223cd1

SHA256
267696cad57a5fc691c787e519ac9e9632f375aabb307c4980ee5bd13bf5e9a0

SHA512
2849b98b9d6ce451409421b12236fa49f1af0e3bc3ed907e4db4f9b706bb356d2ccf7fe0e8cec828e147307cecf1292b2ffb57cfbe04e8f813888f6d52e2c251

Download Submit
memory/584-89-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/584-96-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/772-60-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1268-43-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1620-45-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1620-53-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1656-80-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1656-87-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1680-70-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1680-62-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2344-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2344-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2344-7-0x00000000003A0000-0x00000000003B1000-memory.dmp

Filesize
68KB

Download
memory/2716-27-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2716-19-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2816-35-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2816-28-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2964-71-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2964-78-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3036-12-0x00000000003B0000-0x00000000003C1000-memory.dmp

Filesize
68KB

Download
memory/3036-18-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3036-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads