Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe
-
Size
124KB
-
MD5
6cb62e334dc2c2325c9d98691f0be8d0
-
SHA1
a42fde65ba94f9be9bc0cdf8e002cc2e032ad504
-
SHA256
e5caa697b96ff1c27be55eb8b6cc0e03d14816c821ce952a200210f032d601cd
-
SHA512
0a015243530cbfb15503c40f4709dd682adeee13869ac43a66a2846e3d9f3a55379e9ec7ee09b9732d6252619cfa2f7ff0bf66872b50331c93bf1f3aedcd77c0
-
SSDEEP
1536:A/bszV5YGhRO/N69BH3OoGa+FL9jKceRgrkjSo3E:cGzYGhkFoN3Oo1+F92SP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 42 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoimieh.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qiinea.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sfzad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toapea.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" munes.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruiazes.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoeegak.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kuiefe.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quefuab.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kauixub.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" biuubu.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tgbuh.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leaih.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vuauyam.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hbnis.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vuinu.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hooroh.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" taizoo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zaoes.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dieih.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zivam.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" caati.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qaokit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yuizin.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kiioce.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" paonii.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiiye.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mooalen.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quivo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rdneol.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woaah.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mrxoaj.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" puauwar.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baesiet.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yuuep.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jfbuc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qaucop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foazia.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" coolo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meokoi.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rauijej.exe -
Checks computer location settings 2 TTPs 42 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation hbnis.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation qiinea.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation kiioce.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation mooalen.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation leaih.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation xoeegak.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation meokoi.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation woaah.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation tgbuh.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation paonii.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation yuuep.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation jfbuc.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation yuizin.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation toapea.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation rauijej.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation taizoo.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation quivo.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation biuubu.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation wiiye.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation vuinu.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation zaoes.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation qaokit.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation kauixub.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation vuauyam.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation coolo.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation caati.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation xoimieh.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation puauwar.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation sfzad.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation baesiet.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ruiazes.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation kuiefe.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation rdneol.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation qaucop.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation munes.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation zivam.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation dieih.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation quefuab.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation foazia.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation mrxoaj.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation hooroh.exe -
Executes dropped EXE 42 IoCs
pid Process 3972 caati.exe 2540 hbnis.exe 4708 qaokit.exe 2692 kuiefe.exe 4272 rdneol.exe 4692 xoimieh.exe 1572 yuizin.exe 2652 puauwar.exe 3560 qaucop.exe 4968 quefuab.exe 2036 qiinea.exe 2704 woaah.exe 3716 kauixub.exe 1408 biuubu.exe 4440 tgbuh.exe 4208 kiioce.exe 4328 sfzad.exe 4956 paonii.exe 2076 toapea.exe 2988 wiiye.exe 1516 munes.exe 1172 mooalen.exe 2956 leaih.exe 1216 baesiet.exe 2188 yuuep.exe 2580 vuauyam.exe 1084 zivam.exe 4132 ruiazes.exe 812 vuinu.exe 1132 foazia.exe 2916 mrxoaj.exe 2604 coolo.exe 3168 xoeegak.exe 3624 meokoi.exe 3296 hooroh.exe 3960 rauijej.exe 1392 jfbuc.exe 1220 taizoo.exe 4512 zaoes.exe 4980 dieih.exe 4832 quivo.exe 3848 buiib.exe -
Adds Run key to start application 2 TTPs 42 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\baesiet = "C:\\Users\\Admin\\baesiet.exe /H" leaih.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\coolo = "C:\\Users\\Admin\\coolo.exe /H" mrxoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rauijej = "C:\\Users\\Admin\\rauijej.exe /F" hooroh.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buiib = "C:\\Users\\Admin\\buiib.exe /D" quivo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\biuubu = "C:\\Users\\Admin\\biuubu.exe /z" kauixub.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgbuh = "C:\\Users\\Admin\\tgbuh.exe /d" biuubu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quefuab = "C:\\Users\\Admin\\quefuab.exe /h" qaucop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toapea = "C:\\Users\\Admin\\toapea.exe /M" paonii.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wiiye = "C:\\Users\\Admin\\wiiye.exe /v" toapea.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\leaih = "C:\\Users\\Admin\\leaih.exe /X" mooalen.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuauyam = "C:\\Users\\Admin\\vuauyam.exe /n" yuuep.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qaokit = "C:\\Users\\Admin\\qaokit.exe /v" hbnis.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kuiefe = "C:\\Users\\Admin\\kuiefe.exe /q" qaokit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoeegak = "C:\\Users\\Admin\\xoeegak.exe /F" coolo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caati = "C:\\Users\\Admin\\caati.exe /N" 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ruiazes = "C:\\Users\\Admin\\ruiazes.exe /v" zivam.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiinea = "C:\\Users\\Admin\\qiinea.exe /E" quefuab.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woaah = "C:\\Users\\Admin\\woaah.exe /J" qiinea.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiioce = "C:\\Users\\Admin\\kiioce.exe /R" tgbuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paonii = "C:\\Users\\Admin\\paonii.exe /s" sfzad.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jfbuc = "C:\\Users\\Admin\\jfbuc.exe /s" rauijej.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taizoo = "C:\\Users\\Admin\\taizoo.exe /O" jfbuc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rdneol = "C:\\Users\\Admin\\rdneol.exe /p" kuiefe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puauwar = "C:\\Users\\Admin\\puauwar.exe /t" yuizin.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrxoaj = "C:\\Users\\Admin\\mrxoaj.exe /n" foazia.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hooroh = "C:\\Users\\Admin\\hooroh.exe /R" meokoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mooalen = "C:\\Users\\Admin\\mooalen.exe /Z" munes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quivo = "C:\\Users\\Admin\\quivo.exe /P" dieih.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yuizin = "C:\\Users\\Admin\\yuizin.exe /Q" xoimieh.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauixub = "C:\\Users\\Admin\\kauixub.exe /B" woaah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qaucop = "C:\\Users\\Admin\\qaucop.exe /U" puauwar.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfzad = "C:\\Users\\Admin\\sfzad.exe /A" kiioce.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yuuep = "C:\\Users\\Admin\\yuuep.exe /J" baesiet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuinu = "C:\\Users\\Admin\\vuinu.exe /o" ruiazes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hbnis = "C:\\Users\\Admin\\hbnis.exe /P" caati.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoimieh = "C:\\Users\\Admin\\xoimieh.exe /g" rdneol.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foazia = "C:\\Users\\Admin\\foazia.exe /L" vuinu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meokoi = "C:\\Users\\Admin\\meokoi.exe /J" xoeegak.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaoes = "C:\\Users\\Admin\\zaoes.exe /D" taizoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dieih = "C:\\Users\\Admin\\dieih.exe /C" zaoes.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\munes = "C:\\Users\\Admin\\munes.exe /b" wiiye.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zivam = "C:\\Users\\Admin\\zivam.exe /R" vuauyam.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 2444 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 3972 caati.exe 3972 caati.exe 2540 hbnis.exe 2540 hbnis.exe 4708 qaokit.exe 4708 qaokit.exe 2692 kuiefe.exe 2692 kuiefe.exe 4272 rdneol.exe 4272 rdneol.exe 4692 xoimieh.exe 4692 xoimieh.exe 1572 yuizin.exe 1572 yuizin.exe 2652 puauwar.exe 2652 puauwar.exe 3560 qaucop.exe 3560 qaucop.exe 4968 quefuab.exe 4968 quefuab.exe 2036 qiinea.exe 2036 qiinea.exe 2704 woaah.exe 2704 woaah.exe 3716 kauixub.exe 3716 kauixub.exe 1408 biuubu.exe 1408 biuubu.exe 4440 tgbuh.exe 4440 tgbuh.exe 4208 kiioce.exe 4208 kiioce.exe 4328 sfzad.exe 4328 sfzad.exe 4956 paonii.exe 4956 paonii.exe 2076 toapea.exe 2076 toapea.exe 2988 wiiye.exe 2988 wiiye.exe 1516 munes.exe 1516 munes.exe 1172 mooalen.exe 1172 mooalen.exe 2956 leaih.exe 2956 leaih.exe 1216 baesiet.exe 1216 baesiet.exe 2188 yuuep.exe 2188 yuuep.exe 2580 vuauyam.exe 2580 vuauyam.exe 1084 zivam.exe 1084 zivam.exe 4132 ruiazes.exe 4132 ruiazes.exe 812 vuinu.exe 812 vuinu.exe 1132 foazia.exe 1132 foazia.exe 2916 mrxoaj.exe 2916 mrxoaj.exe -
Suspicious use of SetWindowsHookEx 43 IoCs
pid Process 2444 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 3972 caati.exe 2540 hbnis.exe 4708 qaokit.exe 2692 kuiefe.exe 4272 rdneol.exe 4692 xoimieh.exe 1572 yuizin.exe 2652 puauwar.exe 3560 qaucop.exe 4968 quefuab.exe 2036 qiinea.exe 2704 woaah.exe 3716 kauixub.exe 1408 biuubu.exe 4440 tgbuh.exe 4208 kiioce.exe 4328 sfzad.exe 4956 paonii.exe 2076 toapea.exe 2988 wiiye.exe 1516 munes.exe 1172 mooalen.exe 2956 leaih.exe 1216 baesiet.exe 2188 yuuep.exe 2580 vuauyam.exe 1084 zivam.exe 4132 ruiazes.exe 812 vuinu.exe 1132 foazia.exe 2916 mrxoaj.exe 2604 coolo.exe 3168 xoeegak.exe 3624 meokoi.exe 3296 hooroh.exe 3960 rauijej.exe 1392 jfbuc.exe 1220 taizoo.exe 4512 zaoes.exe 4980 dieih.exe 4832 quivo.exe 3848 buiib.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 3972 2444 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 87 PID 2444 wrote to memory of 3972 2444 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 87 PID 2444 wrote to memory of 3972 2444 6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe 87 PID 3972 wrote to memory of 2540 3972 caati.exe 88 PID 3972 wrote to memory of 2540 3972 caati.exe 88 PID 3972 wrote to memory of 2540 3972 caati.exe 88 PID 2540 wrote to memory of 4708 2540 hbnis.exe 89 PID 2540 wrote to memory of 4708 2540 hbnis.exe 89 PID 2540 wrote to memory of 4708 2540 hbnis.exe 89 PID 4708 wrote to memory of 2692 4708 qaokit.exe 90 PID 4708 wrote to memory of 2692 4708 qaokit.exe 90 PID 4708 wrote to memory of 2692 4708 qaokit.exe 90 PID 2692 wrote to memory of 4272 2692 kuiefe.exe 91 PID 2692 wrote to memory of 4272 2692 kuiefe.exe 91 PID 2692 wrote to memory of 4272 2692 kuiefe.exe 91 PID 4272 wrote to memory of 4692 4272 rdneol.exe 92 PID 4272 wrote to memory of 4692 4272 rdneol.exe 92 PID 4272 wrote to memory of 4692 4272 rdneol.exe 92 PID 4692 wrote to memory of 1572 4692 xoimieh.exe 93 PID 4692 wrote to memory of 1572 4692 xoimieh.exe 93 PID 4692 wrote to memory of 1572 4692 xoimieh.exe 93 PID 1572 wrote to memory of 2652 1572 yuizin.exe 94 PID 1572 wrote to memory of 2652 1572 yuizin.exe 94 PID 1572 wrote to memory of 2652 1572 yuizin.exe 94 PID 2652 wrote to memory of 3560 2652 puauwar.exe 97 PID 2652 wrote to memory of 3560 2652 puauwar.exe 97 PID 2652 wrote to memory of 3560 2652 puauwar.exe 97 PID 3560 wrote to memory of 4968 3560 qaucop.exe 98 PID 3560 wrote to memory of 4968 3560 qaucop.exe 98 PID 3560 wrote to memory of 4968 3560 qaucop.exe 98 PID 4968 wrote to memory of 2036 4968 quefuab.exe 99 PID 4968 wrote to memory of 2036 4968 quefuab.exe 99 PID 4968 wrote to memory of 2036 4968 quefuab.exe 99 PID 2036 wrote to memory of 2704 2036 qiinea.exe 101 PID 2036 wrote to memory of 2704 2036 qiinea.exe 101 PID 2036 wrote to memory of 2704 2036 qiinea.exe 101 PID 2704 wrote to memory of 3716 2704 woaah.exe 102 PID 2704 wrote to memory of 3716 2704 woaah.exe 102 PID 2704 wrote to memory of 3716 2704 woaah.exe 102 PID 3716 wrote to memory of 1408 3716 kauixub.exe 103 PID 3716 wrote to memory of 1408 3716 kauixub.exe 103 PID 3716 wrote to memory of 1408 3716 kauixub.exe 103 PID 1408 wrote to memory of 4440 1408 biuubu.exe 104 PID 1408 wrote to memory of 4440 1408 biuubu.exe 104 PID 1408 wrote to memory of 4440 1408 biuubu.exe 104 PID 4440 wrote to memory of 4208 4440 tgbuh.exe 105 PID 4440 wrote to memory of 4208 4440 tgbuh.exe 105 PID 4440 wrote to memory of 4208 4440 tgbuh.exe 105 PID 4208 wrote to memory of 4328 4208 kiioce.exe 106 PID 4208 wrote to memory of 4328 4208 kiioce.exe 106 PID 4208 wrote to memory of 4328 4208 kiioce.exe 106 PID 4328 wrote to memory of 4956 4328 sfzad.exe 107 PID 4328 wrote to memory of 4956 4328 sfzad.exe 107 PID 4328 wrote to memory of 4956 4328 sfzad.exe 107 PID 4956 wrote to memory of 2076 4956 paonii.exe 108 PID 4956 wrote to memory of 2076 4956 paonii.exe 108 PID 4956 wrote to memory of 2076 4956 paonii.exe 108 PID 2076 wrote to memory of 2988 2076 toapea.exe 109 PID 2076 wrote to memory of 2988 2076 toapea.exe 109 PID 2076 wrote to memory of 2988 2076 toapea.exe 109 PID 2988 wrote to memory of 1516 2988 wiiye.exe 110 PID 2988 wrote to memory of 1516 2988 wiiye.exe 110 PID 2988 wrote to memory of 1516 2988 wiiye.exe 110 PID 1516 wrote to memory of 1172 1516 munes.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6cb62e334dc2c2325c9d98691f0be8d0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\caati.exe"C:\Users\Admin\caati.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\hbnis.exe"C:\Users\Admin\hbnis.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\qaokit.exe"C:\Users\Admin\qaokit.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\kuiefe.exe"C:\Users\Admin\kuiefe.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\rdneol.exe"C:\Users\Admin\rdneol.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\xoimieh.exe"C:\Users\Admin\xoimieh.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\yuizin.exe"C:\Users\Admin\yuizin.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\puauwar.exe"C:\Users\Admin\puauwar.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\qaucop.exe"C:\Users\Admin\qaucop.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\quefuab.exe"C:\Users\Admin\quefuab.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\qiinea.exe"C:\Users\Admin\qiinea.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\woaah.exe"C:\Users\Admin\woaah.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\kauixub.exe"C:\Users\Admin\kauixub.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\biuubu.exe"C:\Users\Admin\biuubu.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\tgbuh.exe"C:\Users\Admin\tgbuh.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\kiioce.exe"C:\Users\Admin\kiioce.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\sfzad.exe"C:\Users\Admin\sfzad.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\paonii.exe"C:\Users\Admin\paonii.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\toapea.exe"C:\Users\Admin\toapea.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\wiiye.exe"C:\Users\Admin\wiiye.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\munes.exe"C:\Users\Admin\munes.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\mooalen.exe"C:\Users\Admin\mooalen.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1172 -
C:\Users\Admin\leaih.exe"C:\Users\Admin\leaih.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956 -
C:\Users\Admin\baesiet.exe"C:\Users\Admin\baesiet.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1216 -
C:\Users\Admin\yuuep.exe"C:\Users\Admin\yuuep.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2188 -
C:\Users\Admin\vuauyam.exe"C:\Users\Admin\vuauyam.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2580 -
C:\Users\Admin\zivam.exe"C:\Users\Admin\zivam.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Users\Admin\ruiazes.exe"C:\Users\Admin\ruiazes.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4132 -
C:\Users\Admin\vuinu.exe"C:\Users\Admin\vuinu.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Users\Admin\foazia.exe"C:\Users\Admin\foazia.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1132 -
C:\Users\Admin\mrxoaj.exe"C:\Users\Admin\mrxoaj.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2916 -
C:\Users\Admin\coolo.exe"C:\Users\Admin\coolo.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2604 -
C:\Users\Admin\xoeegak.exe"C:\Users\Admin\xoeegak.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Users\Admin\meokoi.exe"C:\Users\Admin\meokoi.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3624 -
C:\Users\Admin\hooroh.exe"C:\Users\Admin\hooroh.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3296 -
C:\Users\Admin\rauijej.exe"C:\Users\Admin\rauijej.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3960 -
C:\Users\Admin\jfbuc.exe"C:\Users\Admin\jfbuc.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1392 -
C:\Users\Admin\taizoo.exe"C:\Users\Admin\taizoo.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1220 -
C:\Users\Admin\zaoes.exe"C:\Users\Admin\zaoes.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4512 -
C:\Users\Admin\dieih.exe"C:\Users\Admin\dieih.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4980 -
C:\Users\Admin\quivo.exe"C:\Users\Admin\quivo.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4832 -
C:\Users\Admin\buiib.exe"C:\Users\Admin\buiib.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD53ceb554a1de6266bd86dd7640883ac6b
SHA1f4d65509d9cd3ddf717de51aca47d4f2b6d3d8ed
SHA25660d43d8a77caad5a20e085e87f23c52764598240b0ae08e533b52fb31ce83a11
SHA512ba0af1fc1f8aa5c32fdb53d5d846ca15e9353e01d42665f30f277e32e6eaee46d47ea56557a0684def94cc2bff3fb993c57a6e40fd61e58192270975c3b08b1d
-
Filesize
124KB
MD5a2aadc3ee86ab53e9ec2337decd792da
SHA1ff598f7224eacfceaa2ff1483e1db6ded53b25ba
SHA25617c146276dbbba27cb49165daffb49f237b466bfb825d6cdc50d3c820c51a667
SHA512ed5a3a369a893a803a3d87284252c2dffbfcf8a4d833bc5fcfefc6a8731775c665c8d85b03c522ec12af5a279d3a95f9a6fe3b4a31213c608616dd9546b100f6
-
Filesize
124KB
MD51f45ed4ccba6858e212d75f2dd8d3b63
SHA11757bd95cf4f3eac853181a0f58762e1c4911e78
SHA25623ecb641d7f5382f862aaa14c67a3f566c8824f219a188aed42d7e69cb2aed7c
SHA512eb53b4ccc41ef62e449062b1355f69b245771d5f1016a453d6858f2d0285bfb6917f88e2bf87f6679ebc64e2ddca0e0e38522c3fa99ce08a5ae925606df2a9ce
-
Filesize
124KB
MD5c0b1702acb0aaebe7c211d457ddb0340
SHA116df93bc93c541999ea8394a506b26d1d5c38f70
SHA2565e029bac5cc1f2afa5322c213547a92072da8d505b16d60c5f471ec406005afb
SHA51248c046c9cb2f5951145b45f33a25f1130ef773009d8a921577b625293490a88b416dc1593625bfc6d4268b771590703a9521010ae9f7b549bbe4e25299544f7b
-
Filesize
124KB
MD5646af51e840aa41a6bbcfe114768d77d
SHA13c088576a85046fe485db0ca0427565cf742826e
SHA256192aedbfbd53cc83086ec5e026806876f960a45c96f5619e8aa938dd6d3e5dba
SHA5123579deeccbd1866d112663e09c5121d256db88b2e7b342f66eea40a6857811dc04dc368b609cfc5d97c56f19da38588cdc89b19583ad5640495fa3be94fcc0cc
-
Filesize
124KB
MD557270465bc3cc993a3e37bbe0c70d2bd
SHA11cebb13e48d477386025e8c7165e9778cabe6749
SHA25614bd47e2be0d3f54c6139317b98abcfa4e3a517eab8dae61365be67b18f8defc
SHA5123dc14d68c081c59e33ae83176845d4e47166921b12d7e031c95de7bb1fb92be7b407e3e4cf758b72e0903d3108c1666e6e3e257ea97a6d26d83a4383d2a7635e
-
Filesize
124KB
MD5ecde8a5156eb7968e43dfbc6909b9a47
SHA1b41ff2874e11c000fba017252ce9555098b053ba
SHA256d5a6ca9da4d7b9d7bec62b3b9e36604fa01dfad360a94d1b0db14846ee78400d
SHA512b849570b9f31243df482a4493685246167932b75379a9509f7f7ef357c9711bc676f76c3d7f913bf91f1fe5873a72adeda9e0bac1e59f098fefd866cb305d4b6
-
Filesize
124KB
MD5bba0e3a5794e079a3099a462cc66ff88
SHA116d4abe6871d97335820317204369dbbf4cb6b1a
SHA2568e32423f011c659d45de63d3854e6a25b81966bb5a5514edbfde972db5a9f7a9
SHA512fd63a72d82b93b3fe509b3afe79f11f94c779de126f53fd19e8e19178d357efbae7633de77c3fec41101f73d6e574bf368c6d554fdf5692fee91b6046a669c51
-
Filesize
124KB
MD5ecc68bcf5c5f8c1ba7a4ac0766bbed1f
SHA14f5a6d674e921d436177a3d57055106c2cb53752
SHA256f99606fb5e585d5fcbfc07483630f74a1cab16c9b34cca3700896f683434328c
SHA5125416ff2754944cb17d6f2c4321abf32d0ee4e610abc204fb98dd6bf685784ed0ba543454302de040b9920f3af0b6fd9b1ce485a136e43369fc6b6cd1da9dc6d2
-
Filesize
124KB
MD59bfa8dcb8c733fe121e0725355326b8b
SHA15650c3d548e8bc385d41b42073034c1c412423a3
SHA256b422ba09cfce40d68fe59d8dd688b6e04b4e7f1a810f165f8c6067767c84caaa
SHA5125a201d16349b84ad64b37ee646093654c61c078612d2b941b75087ed8696be8024db03cfa7fa54f7d4581e121204daffb303931e1af159165f5deb6e67e7efa5
-
Filesize
124KB
MD54fea7970617afaab618b71566506bde7
SHA1be313994b306df0dcc4cab7619a4dba54d572fcd
SHA256967a2f2e7d80525d00e81c6c59aa2ed0597a821a209c13a37c668ed5855c2751
SHA5122f1dfbec10ba511b2a6fa4a95997049d23c566d13b30b8791b3d2de1af0e85a4e12a7b2db96cdabd98ad3d7f2c7e90ca7d2c06dfa3987adf900f3c84796ff6d4
-
Filesize
124KB
MD5211f2fe04e4574802bc41506a763ac98
SHA1945b532210c2b4eba44c73624f6c75871c3a1246
SHA256b83c865b15636f3e4a6eda8a058f5381c28cff8f0a48863af293d3e06b439663
SHA5125efaeb3370d745374ab99f1a0462790a816326350cb36aacc75e828214f6b81c4ef65d87555466e84d235b6aab3124b42423710d2edde9ab94ee15e5a2801d1e
-
Filesize
124KB
MD5476ec240d3a1665518696993d47eecbb
SHA13f9fa7f3139e34794278019146ab4ee9dbd6fef9
SHA25681b364d99efc53e87f6aab36bd6987f705dde654a2527ff5e5ffaa7478c81af6
SHA5127db29e1b4f38f9fbf6afaf189acb78a1d0e4b19bb56f0ba41cf63f91455373a61e9876b6efdc3702685694785afa1b418e8f7f8943cdf77615ee8c791dacc94a
-
Filesize
124KB
MD5ec36a118f395ef411b1d7dd0f14aa4c7
SHA1aeaade18e39a02c6ca06c3408c726b99cb26e2ef
SHA2569e1c7d20fb2d67dbbf10aa323a8c826e47ca1be199a35beb247765fd6f3b4aaa
SHA512fd9306075a1d5caf2981de1f22cc0f1e1d8b8e579ba497064b60dbc9fb2d403fdfa9c295afb528fcd75b2ed77a3d51dbd506e09a8881b2ba89c71712c7f18a39
-
Filesize
124KB
MD5613e5848708d12bbee456a6a427c6e15
SHA128e8bfedbfb4cb24ec6a17f7b77facbc2d17fc7b
SHA25619c92e745121fff70be6d08707adb3beba673c9c7c6ced2eace333a767d7f4af
SHA5125c78d24a51bf5680ecbf438457a7a083d8f903968315ecec02be6ce65c6b85bcb733cb9eb81a20c7e9b40bc68643db66b4d66ab5761f94e97393b718b6e716f0
-
Filesize
124KB
MD54c369bb085d0b1bd538cb1b55a1fae63
SHA1de94f7aa5fa6e3ac02eaf030d1b53b7b3a11850a
SHA256d553adb95a457369b26f5149f6678ee2c8148861a1527003938814a1aa5a72dc
SHA5129c0c56b6ffe959ce1e973d805a69de76cee5c5075623649f59fe778531396e31f410cde23a6c8204879c2f399eb789ff864b74cf99a937ab1806e53de634cf17
-
Filesize
124KB
MD559469d835c466388ae41744f29360f0b
SHA1b2975ac36cae4b27b65ab5568713934fc1b49034
SHA2562411d6890ffe7655791a9a30895aa1ced13580486851d2644acfc4b4780dbad3
SHA512eb05f1eff3d8bc91d387c4146d989b505bcc6061cb33b276f8d4c572cefaaabc6a9aa576668ab10bbaf170476e0a4dd42c5e99e0edf36cf8375dcb8ac45b16db
-
Filesize
124KB
MD545210b38f4e1471410ff755f85fa0101
SHA17648bc01fa18e1d6eb1e1914232ee93f8e965e70
SHA2563dedb3e75041407d3a45c57bb708f6c9db4f533791e5beb95fb0a11a280b65df
SHA5129601759a98a150d1361067456c2bcf056da9ef1fa74c954d60deb89686309041af5697483db6da4f118644c3cd40fdd71b02f9a460a6b2b83421425b2da0a3dd
-
Filesize
124KB
MD5c6a8f577396ce5e9d98a533fd8eb50bc
SHA1e29f275573e10fc3b9221d9e110b33d57da188fb
SHA256e786b2c0fff680bdd0d7c59e5f6a2961ccc32a0caad0fc8019a2c3a2d080d781
SHA512fbe6e050cc01704c6c2295ef8e9fec48ee3c6d0232f7a1140e5088f66f97dd72e70d4854325e6e71267c0f118cb5661e0c991fc18fef7c039b21e6391d61149a
-
Filesize
124KB
MD5571582d6dffd8ddfc6adb978e4393aa6
SHA12f0aa9ec2c67aca14169d2402c31f29079dd4577
SHA25691ba0e2e58248ceb395efab9e418b3e1378141e0fe46ede953851485701d0f93
SHA512b10d8129f44a2f5e632ef45fdf53d15e2596918be9f9e096cf82368942850886dcfac51f37da5df1ccd81f305cd74ad210116b5babd829a7b9bbcd66013d7e76
-
Filesize
124KB
MD546ee358b085cc1172b5a5f5fca6a3c0a
SHA1687f2d7a114d9990ee13b4858d6930b754f90487
SHA25627f078b80bf98524db3dae7a199b9bed86558f985650db8e9542ff07aa64eca1
SHA512a365d66412313be345907bda7b9da1a1dd82b8f608becd3c69e0a0fe1e9eb19a02f517096c9f4d08ecdc220171c8514ea90b3c9b053e96976616b97f948dd71a
-
Filesize
124KB
MD56b3a43256e2f74cda17c42111366c2c8
SHA1e4c10d83e7768940f5037f080916eb798f6df56e
SHA256b91682eeae4e66dce716f76b638844ba89c4377c61cd77470c84196e69d8f216
SHA512737f88e3037a89b51326ae432a365eae79154ee267ec32557a676320a1162a76441d728a93534b0d72627a1438e1ad4dc72ef094635570389b2dac6a9445e0ac
-
Filesize
124KB
MD5f1783e1e0e620e398ab3a72576b5d626
SHA1e6fdf1178c4fef9d1f83d04dc0cb37cdee612971
SHA256c35994c9bd829770793cbf64141ad8d98a821995d9ccad965890a7e9710dab42
SHA5121895b435f17ddd11567976dab8692b0f51e147d838e98c85a7549a6b84f47dfba00f8abd95bb799e615bc56627756487883570d740c2ccb23e696f2653fdbd72
-
Filesize
124KB
MD5b32ef4c4e08bd89a89740316f9b8f33b
SHA11933336224fc6954e70082500632ab5f5743715c
SHA256926d659df513a868086acdbafe870f701e1aa060fa397f4120b72c57e2cae5b1
SHA512c45c13645a3b976df1b3b5e65ac065eb1710f4edba64c866aba7495906922639bf963739e93cd32d54b67deff0375142328ef1a12195a6a9e5966839b8410007
-
Filesize
124KB
MD518151ec947fe24d4e34d55783c21c35e
SHA1bada8e0857493154de3146333ee526222f891be8
SHA2567b298440f675efbdc888a4239babd8671c156773328afcba2afd9de9d888365a
SHA5124f9dc0aaf363da1f5124feecad9f95bd82667e0490047cd3644fc0a7a4526a07e82d21256630feb58e2e251606b63d10b0d22c113d6f64c41f3124d80637ea1f
-
Filesize
124KB
MD5411bc9ab34133b08285d7a39d54899d7
SHA11d27019ab1efe6a9bf7d40e437efe924bfd1a0ea
SHA2569f1b1d2755841e98cdbb6fe434228c079ad34190c5b55b263c337f94dac78d0e
SHA512b40f8e3a0f1e8be7572736a30fab3f1a226890c5a5d0a0c6f2eda88e5c61a7c88ca0a9589d99dc60021184ac620171b6e8237e2a5476a3eb7d0b3c582c53cb8a
-
Filesize
124KB
MD543ad73a142285690b1995857596ed3d8
SHA123def46745905a80b45db10968ee6980f50e03b5
SHA256a9bf7c1465126c85584b2f01791cb058e71d4f284d544a1162e36010886313ed
SHA5125743a3cc8245e26a8f7e9c541b60ff104d795db299ab92ac4064683db445e959df6cb0868115128ca29288cbdfc39ad53f9517afb4adafeeaef5999fdf75c46a
-
Filesize
124KB
MD5e6c388b66b7e18f61ddc04af22a57d3a
SHA1481009e8482d3a0a5fdd8a6a78e312bf9f5b793c
SHA2568332fc3bfe263d4f3ae67e89d02b2425188482d41544d31057cfa51347264ee8
SHA512e9399c6e9b29aaea26def61abcbc381bb133cb0ecbc7948dddeae5dbcbeca56a19036269b2b9bdfeb7cd91a02cdb4cf16e3f413d0caa3784a9d7b6aed91a0c76
-
Filesize
124KB
MD572c176feadaa657f6a5455176d0ba5fc
SHA141ad2dd3d87e4f9b0b72b1244eb6671a2f4f7be8
SHA256ee1c9266ba9a3a85a16542857251297a95cca5c9af6d46f3ae49d00bc25acba1
SHA512b5a27cc9a01b6ed93690ef914db8a2edd158bf4ab3143e7474209ed41f4709904334dac86f8f9334ec9e15acb64148835d0fab544e191ffcf7ec0ba90248f24c
-
Filesize
124KB
MD5f18264d1e6012851ed31d1373d410b34
SHA10f10737b41050db4eef0207436092b21d2d0acbb
SHA25699455d91f2198a7b95eda8d35d0f3944d8f0dcaccdde063be2e5f342bd5f4dbd
SHA512c33f1c6bfdb4fd3302a5b15567739b1be8c740feb9fbb3640665e5b5079cb09e3cdfbc8d66e220b3e6a2e8c7911e5d163fcc505fe97824e4ab8f41740c0fadc2
-
Filesize
124KB
MD5d42d7279788e88f2b85324a98739d0e2
SHA1ba804ce5f28cda79d5858b313ce5b8443cc6ede3
SHA2563b3f9f428c7f28b13e936390b813a65e11e832fe14515a74736a56f257a6d221
SHA512767fbd606a9c6b9e3e7966f4d74d7d905071b0b0425782499be3458a69fd2064a7bad8aae8fb0c5dc2fe884c0dc885ac4080507f6a32bf61c5c8362a5e8cfdcc
-
Filesize
124KB
MD5ca9c188f68bf1fd8824fbcecc2940a24
SHA166cf213935c3232fc6d650b951e620130997da5d
SHA256e91d91410c68f6e507ce62d65d69b05958c55de38a27253fc05d8d521d4045be
SHA5124ecc9d9046cf3cf471a11b2a183cd6e4ba8cfcda6c99a554eabc4959b92057a70d29bf108d1e94e754cb7a344d5dab4f6d99a930e8308c448f97cb5e3d51315b