Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 12:33
Behavioral task
behavioral1
Sample
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
d22711d7b799dc3db2c419f2fd5f9430
-
SHA1
4ffaadc81a24afaad091adb758bc41361b9c6197
-
SHA256
ac642f44dade714a85fb5d214db6250cab8e0934058dda42e9c369dabba97c71
-
SHA512
331f3b6fc9155592062c06be8fabf595ea24dbc2af5af490e91b59dd6799b6c19badfa579867801c47502b9aea2cb0526e3b75fa4d063e64366e06c2e62ed1ee
-
SSDEEP
49152:yH64y2XDuLlIY14o9/yDzr1xJ8XbRrC9mWvR08Yv7yP3GcY:yHfE5Ad8Xd295UmGc
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 16 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\", \"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Users\\Default User\\winlogon.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\", \"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\", \"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\", \"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\", \"C:\\Users\\All Users\\sppsvc.exe\", \"C:\\Windows\\SchCache\\lsass.exe\", \"C:\\Windows\\AppCompat\\Programs\\services.exe\", \"C:\\Windows\\AppPatch\\csrss.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\", \"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Users\\Default User\\winlogon.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\dllhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\lsm.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe -
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2544 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2436 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3056 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1912 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2668 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2696 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2556 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 288 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1864 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1860 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1572 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 284 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2892 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2172 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2180 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1904 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2816 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 692 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2820 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2348 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1272 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2972 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 972 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2328 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 240 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1984 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2836 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 1280 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 1280 schtasks.exe -
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exesppsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sppsvc.exe -
Processes:
resource yara_rule behavioral1/memory/2240-1-0x0000000000DD0000-0x0000000001090000-memory.dmp dcrat C:\Program Files (x86)\Google\CrashReports\lsm.exe dcrat C:\ProgramData\sppsvc.exe dcrat C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe dcrat behavioral1/memory/2260-182-0x0000000000170000-0x0000000000430000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 1 IoCs
Processes:
sppsvc.exepid process 2260 sppsvc.exe -
Adds Run key to start application 2 TTPs 32 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\dllhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\SchCache\\lsass.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\AppPatch\\csrss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\AppPatch\\csrss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\lsm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files\\Windows Defender\\ja-JP\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dllhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\AppCompat\\Programs\\services.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\AppCompat\\Programs\\services.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\taskhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Google\\CrashReports\\lsm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\sppsvc.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\SchCache\\lsass.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\Web\\Wallpaper\\Architecture\\smss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\lsm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default User\\winlogon.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\dwm.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\All Users\\sppsvc.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\dllhost.exe\"" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe -
Processes:
sppsvc.exed22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sppsvc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sppsvc.exe -
Drops file in Program Files directory 16 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Mozilla Firefox\fonts\dllhost.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\RCX3553.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\dllhost.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\taskhost.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\CrashReports\lsm.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\ja-JP\taskhost.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\ja-JP\b75386f1303e64 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\lsm.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\RCX2A66.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\RCX1D65.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\RCX2F48.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\csrss.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\CrashReports\101b941d020240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Portable Devices\csrss.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\fonts\5940a34987c991 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe -
Drops file in Windows directory 16 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exedescription ioc process File created C:\Windows\SchCache\lsass.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\AppCompat\Programs\services.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\AppCompat\Programs\c5b4cb5e9653cc d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\Web\Wallpaper\Architecture\69ddcba757bf72 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\AppCompat\Programs\services.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\SchCache\lsass.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\AppCompat\Programs\RCX23ED.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\AppPatch\RCX25F1.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\Web\Wallpaper\Architecture\RCX2CD7.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\SchCache\6203df4a6bafc7 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\AppPatch\csrss.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\SchCache\RCX21DA.tmp d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\AppPatch\csrss.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\AppPatch\886983d96e3d3e d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File created C:\Windows\Web\Wallpaper\Architecture\smss.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe File opened for modification C:\Windows\Web\Wallpaper\Architecture\smss.exe d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe -
Creates scheduled task(s) 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1572 schtasks.exe 2852 schtasks.exe 2172 schtasks.exe 2180 schtasks.exe 3056 schtasks.exe 2696 schtasks.exe 2260 schtasks.exe 1860 schtasks.exe 936 schtasks.exe 2884 schtasks.exe 1912 schtasks.exe 2556 schtasks.exe 1864 schtasks.exe 1524 schtasks.exe 1960 schtasks.exe 1160 schtasks.exe 2752 schtasks.exe 2892 schtasks.exe 2816 schtasks.exe 3028 schtasks.exe 2820 schtasks.exe 2328 schtasks.exe 2104 schtasks.exe 2544 schtasks.exe 1932 schtasks.exe 1532 schtasks.exe 972 schtasks.exe 240 schtasks.exe 1984 schtasks.exe 2836 schtasks.exe 2024 schtasks.exe 2480 schtasks.exe 2348 schtasks.exe 1272 schtasks.exe 1904 schtasks.exe 692 schtasks.exe 1728 schtasks.exe 2436 schtasks.exe 288 schtasks.exe 1700 schtasks.exe 2972 schtasks.exe 1792 schtasks.exe 1300 schtasks.exe 2040 schtasks.exe 2960 schtasks.exe 2668 schtasks.exe 284 schtasks.exe 2356 schtasks.exe -
Processes:
sppsvc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 sppsvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 sppsvc.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
sppsvc.exepid process 2260 sppsvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exepowershell.exesppsvc.exepid process 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe 2448 powershell.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe 2260 sppsvc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exepowershell.exesppsvc.exedescription pid process Token: SeDebugPrivilege 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Token: SeDebugPrivilege 2448 powershell.exe Token: SeDebugPrivilege 2260 sppsvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.execmd.exedescription pid process target process PID 2240 wrote to memory of 2448 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe powershell.exe PID 2240 wrote to memory of 2448 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe powershell.exe PID 2240 wrote to memory of 2448 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe powershell.exe PID 2240 wrote to memory of 2324 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe cmd.exe PID 2240 wrote to memory of 2324 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe cmd.exe PID 2240 wrote to memory of 2324 2240 d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe cmd.exe PID 2324 wrote to memory of 288 2324 cmd.exe w32tm.exe PID 2324 wrote to memory of 288 2324 cmd.exe w32tm.exe PID 2324 wrote to memory of 288 2324 cmd.exe w32tm.exe PID 2324 wrote to memory of 2260 2324 cmd.exe sppsvc.exe PID 2324 wrote to memory of 2260 2324 cmd.exe sppsvc.exe PID 2324 wrote to memory of 2260 2324 cmd.exe sppsvc.exe PID 2324 wrote to memory of 2260 2324 cmd.exe sppsvc.exe PID 2324 wrote to memory of 2260 2324 cmd.exe sppsvc.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
sppsvc.exed22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sppsvc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d22711d7b799dc3db2c419f2fd5f9430_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2240 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RsyzSKYRe6.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:288
-
C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe"C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\CrashReports\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\SchCache\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\AppCompat\Programs\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\AppCompat\Programs\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\AppPatch\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\AppPatch\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\AppPatch\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\ja-JP\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\ja-JP\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Web\Wallpaper\Architecture\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Architecture\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Web\Wallpaper\Architecture\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\fonts\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\fonts\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5d22711d7b799dc3db2c419f2fd5f9430
SHA14ffaadc81a24afaad091adb758bc41361b9c6197
SHA256ac642f44dade714a85fb5d214db6250cab8e0934058dda42e9c369dabba97c71
SHA512331f3b6fc9155592062c06be8fabf595ea24dbc2af5af490e91b59dd6799b6c19badfa579867801c47502b9aea2cb0526e3b75fa4d063e64366e06c2e62ed1ee
-
Filesize
2.7MB
MD530acfb583f596ace2754a41bfdbd81e2
SHA1da0e4d8c959c44ef390a295760fabab406193e95
SHA25607c259a6e0a61b3a33ca5555b8563be0a29052f9b821db2f324e070e44520764
SHA512d9e89d806ea005b6a2168a949251b8f3d59a8dc0404fe87aba3caab36595e32f5c99290cca78be4952c8d8abe74bb3a7e49c7e1da8247c64c5f66c4cca30884f
-
Filesize
2.7MB
MD57120952a606dfeec327cd42deae22fa1
SHA1144d930204f65216243f35621fe9271c5e2062b3
SHA25616bc1e772481bbab47968ded4a6c694c8dd48184114d2d4bdcca16a67a4248bd
SHA5120ca29a1c4be1f4a1473200204662e346c0879aef3b3709d6e4d4c694d586af8391bba4a99ffcc18bbfbd80fb29d39f9663739bd3d4880d44af89d25343e9df00
-
Filesize
224B
MD59277fa285a4a615e28a1ee68112a7390
SHA1882fbb5f9186bb7d1cc747710f46866935d0353f
SHA256a9804ce23b84a74cad89406e9d86ceeb5b10c42199e740ea9fbcd57cd9736e3a
SHA5124faf7fa02a450eda968033026ce6d1cac0f22600f356d556bd4b3cb6e3b0eab517f2247ac0b883b63d66cff8592fa0e136168b1947ff27fab8abba4a2d029389