Analysis
-
max time kernel
131s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5329cdeaab5392b315d8c3b9770a9e60_NeikiAnalytics.dll
Resource
win7-20240419-en
windows7-x64
15 signatures
150 seconds
General
-
Target
5329cdeaab5392b315d8c3b9770a9e60_NeikiAnalytics.dll
-
Size
120KB
-
MD5
5329cdeaab5392b315d8c3b9770a9e60
-
SHA1
f4f951c659c043800bc49ba30c4f7a09d408871d
-
SHA256
4298482bcd2d34520996a6ab20852c53e071db85e2b2b0a9dada3ad9725464a3
-
SHA512
a38c8aae47e3734bb4d22a44b5216153278e7067a250fff601305ee2c4d20796f64a211999daab61d4856d1097c2c5e63e2f62727f84f97d22b7ee3d20c1c3bd
-
SSDEEP
1536:1lAcs9dMUkD2j5pEZtutIJmJynO4VJmV0WKCJ/uhddHYVnBPW5cp415XtC2KW6Ar:DARMdycZtutINVQcCJWd1YpVNp41621
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57415e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57415e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575d14.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575d14.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575d14.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575d14.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575d14.exe -
Executes dropped EXE 3 IoCs
pid Process 3408 e57415e.exe 2336 e574258.exe 3108 e575d14.exe -
resource yara_rule behavioral2/memory/3408-10-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-25-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-12-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-31-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-26-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-32-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-27-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-11-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-8-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-9-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-6-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-37-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-36-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-38-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-40-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-39-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-42-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-43-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-53-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-54-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-55-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-66-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-67-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-70-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-72-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-73-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-75-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-76-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-77-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-87-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-88-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3408-94-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3108-125-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575d14.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57415e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575d14.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57415e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575d14.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e57415e.exe File opened (read-only) \??\O: e57415e.exe File opened (read-only) \??\S: e57415e.exe File opened (read-only) \??\E: e57415e.exe File opened (read-only) \??\H: e57415e.exe File opened (read-only) \??\P: e57415e.exe File opened (read-only) \??\Q: e57415e.exe File opened (read-only) \??\G: e57415e.exe File opened (read-only) \??\K: e57415e.exe File opened (read-only) \??\N: e57415e.exe File opened (read-only) \??\R: e57415e.exe File opened (read-only) \??\M: e57415e.exe File opened (read-only) \??\J: e57415e.exe File opened (read-only) \??\L: e57415e.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57415e.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57415e.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57415e.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57415e.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57ab82 e575d14.exe File created C:\Windows\e5741ac e57415e.exe File opened for modification C:\Windows\SYSTEM.INI e57415e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3408 e57415e.exe 3408 e57415e.exe 3408 e57415e.exe 3408 e57415e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe Token: SeDebugPrivilege 3408 e57415e.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 728 wrote to memory of 2604 728 rundll32.exe 83 PID 728 wrote to memory of 2604 728 rundll32.exe 83 PID 728 wrote to memory of 2604 728 rundll32.exe 83 PID 2604 wrote to memory of 3408 2604 rundll32.exe 84 PID 2604 wrote to memory of 3408 2604 rundll32.exe 84 PID 2604 wrote to memory of 3408 2604 rundll32.exe 84 PID 3408 wrote to memory of 780 3408 e57415e.exe 8 PID 3408 wrote to memory of 788 3408 e57415e.exe 9 PID 3408 wrote to memory of 316 3408 e57415e.exe 13 PID 3408 wrote to memory of 2476 3408 e57415e.exe 42 PID 3408 wrote to memory of 2500 3408 e57415e.exe 43 PID 3408 wrote to memory of 2664 3408 e57415e.exe 44 PID 3408 wrote to memory of 3160 3408 e57415e.exe 54 PID 3408 wrote to memory of 3672 3408 e57415e.exe 57 PID 3408 wrote to memory of 3864 3408 e57415e.exe 58 PID 3408 wrote to memory of 3956 3408 e57415e.exe 59 PID 3408 wrote to memory of 4024 3408 e57415e.exe 60 PID 3408 wrote to memory of 388 3408 e57415e.exe 61 PID 3408 wrote to memory of 3992 3408 e57415e.exe 62 PID 3408 wrote to memory of 436 3408 e57415e.exe 64 PID 3408 wrote to memory of 2536 3408 e57415e.exe 75 PID 3408 wrote to memory of 1044 3408 e57415e.exe 80 PID 3408 wrote to memory of 4888 3408 e57415e.exe 81 PID 3408 wrote to memory of 728 3408 e57415e.exe 82 PID 3408 wrote to memory of 2604 3408 e57415e.exe 83 PID 3408 wrote to memory of 2604 3408 e57415e.exe 83 PID 2604 wrote to memory of 2336 2604 rundll32.exe 85 PID 2604 wrote to memory of 2336 2604 rundll32.exe 85 PID 2604 wrote to memory of 2336 2604 rundll32.exe 85 PID 2604 wrote to memory of 3108 2604 rundll32.exe 94 PID 2604 wrote to memory of 3108 2604 rundll32.exe 94 PID 2604 wrote to memory of 3108 2604 rundll32.exe 94 PID 3408 wrote to memory of 780 3408 e57415e.exe 8 PID 3408 wrote to memory of 788 3408 e57415e.exe 9 PID 3408 wrote to memory of 316 3408 e57415e.exe 13 PID 3408 wrote to memory of 2476 3408 e57415e.exe 42 PID 3408 wrote to memory of 2500 3408 e57415e.exe 43 PID 3408 wrote to memory of 2664 3408 e57415e.exe 44 PID 3408 wrote to memory of 3160 3408 e57415e.exe 54 PID 3408 wrote to memory of 3672 3408 e57415e.exe 57 PID 3408 wrote to memory of 3864 3408 e57415e.exe 58 PID 3408 wrote to memory of 3956 3408 e57415e.exe 59 PID 3408 wrote to memory of 4024 3408 e57415e.exe 60 PID 3408 wrote to memory of 388 3408 e57415e.exe 61 PID 3408 wrote to memory of 3992 3408 e57415e.exe 62 PID 3408 wrote to memory of 436 3408 e57415e.exe 64 PID 3408 wrote to memory of 2536 3408 e57415e.exe 75 PID 3408 wrote to memory of 1044 3408 e57415e.exe 80 PID 3408 wrote to memory of 2336 3408 e57415e.exe 85 PID 3408 wrote to memory of 2336 3408 e57415e.exe 85 PID 3408 wrote to memory of 3384 3408 e57415e.exe 87 PID 3408 wrote to memory of 2748 3408 e57415e.exe 88 PID 3408 wrote to memory of 3108 3408 e57415e.exe 94 PID 3408 wrote to memory of 3108 3408 e57415e.exe 94 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575d14.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57415e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2500
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2664
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3160
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5329cdeaab5392b315d8c3b9770a9e60_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5329cdeaab5392b315d8c3b9770a9e60_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\e57415e.exeC:\Users\Admin\AppData\Local\Temp\e57415e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3408
-
-
C:\Users\Admin\AppData\Local\Temp\e574258.exeC:\Users\Admin\AppData\Local\Temp\e574258.exe4⤵
- Executes dropped EXE
PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\e575d14.exeC:\Users\Admin\AppData\Local\Temp\e575d14.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:3108
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3672
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3956
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:388
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:436
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2536
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1044
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4888
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3384
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2748
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD50f5e7469fc03ad46251eb7501f1cbff5
SHA130f63ee0e3b82a4c53e9b459111c4b3256f833ef
SHA25629b47ee57b43981d78ae40b5c32ce38211cfaade9f8d342612e734616e07c601
SHA5128d28af2f376c22a3c649d2594905283fe3ece5953e11f62c5c42d372b668dc8b00c224fe5e65511db0689280a15b8b1a4b40864172f26d12230a02bf9e1f51de
-
Filesize
257B
MD5387e3f91771e1ad7ef3eb3b12c8017e0
SHA117610bd21f214ac62127041ad07db60d93dd44e7
SHA256ea12a9ba61c70cf68f8c9bb484ec1f72f448607112c0232a03dc06bde1d2fe63
SHA512add1a3a6a1e7046f5fd33772ec53fcdae1254e1d1b820e81f7db15c45cae5917703b22587af6ec8939a833f53b84701d746bc4f5243f9e3f35dde0b8123b4b32