Malware Analysis Report

2024-11-13 13:42

Sample ID 240516-sw1y8sba7x
Target e349210264df2c9c8513e938aa1f3940_NeikiAnalytics
SHA256 4d520afba4c682d393f2979de1abea0e96ec9f84f2b1d0164b57eea4eea15175
Tags
rat dcrat evasion execution infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d520afba4c682d393f2979de1abea0e96ec9f84f2b1d0164b57eea4eea15175

Threat Level: Known bad

The file e349210264df2c9c8513e938aa1f3940_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion execution infostealer trojan

DcRat

Process spawned unexpected child process

UAC bypass

Dcrat family

DCRat payload

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

System policy modification

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 15:29

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 15:29

Reported

2024-05-16 15:32

Platform

win7-20240221-en

Max time kernel

149s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Mail\es-ES\b75386f1303e64 C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Mail\it-IT\RCX379C.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Mail\it-IT\services.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\es-ES\RCX3C7E.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Mail\it-IT\services.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Mail\it-IT\c5b4cb5e9653cc C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Resources\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Vss\Writers\RCX2D1C.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Vss\Writers\Idle.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Resources\RCX3327.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Resources\csrss.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Windows\Vss\Writers\Idle.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Windows\Vss\Writers\6ccacd8608530f C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Windows\Resources\csrss.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
N/A N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2872 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 468 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2872 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2872 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2872 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1724 wrote to memory of 2880 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1724 wrote to memory of 2880 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1724 wrote to memory of 2880 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1724 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 1724 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 1724 wrote to memory of 2920 N/A C:\Windows\System32\cmd.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 2920 wrote to memory of 2836 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 2836 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 2836 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 376 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 376 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2920 wrote to memory of 376 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2836 wrote to memory of 1128 N/A C:\Windows\System32\WScript.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 2836 wrote to memory of 1128 N/A C:\Windows\System32\WScript.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 2836 wrote to memory of 1128 N/A C:\Windows\System32\WScript.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 1128 wrote to memory of 2088 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 1128 wrote to memory of 2088 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 1128 wrote to memory of 2088 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 1128 wrote to memory of 2124 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 1128 wrote to memory of 2124 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 1128 wrote to memory of 2124 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe
PID 2088 wrote to memory of 892 N/A C:\Windows\System32\WScript.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 2088 wrote to memory of 892 N/A C:\Windows\System32\WScript.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 2088 wrote to memory of 892 N/A C:\Windows\System32\WScript.exe C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe
PID 892 wrote to memory of 1288 N/A C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\Vss\Writers\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Resources\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Downloads\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\it-IT\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\it-IT\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\it-IT\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\es-ES\taskhost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5aHV7JTKGb.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

"C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88d6643c-1c32-4cb2-ac5c-835ca516018b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\91a01db5-f4c4-4eb2-814d-3764b79dcf51.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c5f9120-874d-4592-adf9-28dad0f4f728.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4d8aa18-d177-4acc-9eac-4f14cac5a3a7.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0691a621-351c-4329-a175-6ff3e0e6cb75.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3c15762-b7f4-4b15-be67-bdecf9b519d5.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c75006b-6bf2-4c39-af40-b75eedf8863f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5be379ca-007c-48fb-b870-5b7d2be66120.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d777272d-2e32-4c3b-9479-5c54a82d058b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c87b5ce9-93e3-4e6a-8f21-c873a246ef5e.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d98a413e-6e9e-4ac8-8e39-c09a15ff1e0f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5fe9278-9572-4cc6-af15-4dad7e18ec63.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36e9956a-823e-4fc7-83e6-650a72d7fe55.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53e38331-93bc-4af7-b358-256bae17fe6c.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ac724b0-6d26-4e2c-803d-fee9a339a226.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89c1fea0-d71b-451d-b12c-0666a8631601.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eea7e8ad-dafe-4f5a-9f3a-35850fda8351.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\200553f5-2a17-483c-944b-6ff2508c20f5.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a057145-b7a3-4298-80db-9d12830dc7ee.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86025ee7-4dbd-4f75-97d9-29c9e6a7b805.vbs"

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\audiodg.exe

Network

Country Destination Domain Proto
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp

Files

memory/2872-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

memory/2872-1-0x00000000008A0000-0x0000000000B86000-memory.dmp

memory/2872-2-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

memory/2872-3-0x00000000004D0000-0x00000000004EC000-memory.dmp

memory/2872-4-0x00000000004F0000-0x00000000004F8000-memory.dmp

memory/2872-5-0x0000000002220000-0x0000000002230000-memory.dmp

memory/2872-7-0x00000000022D0000-0x00000000022D8000-memory.dmp

memory/2872-6-0x00000000022B0000-0x00000000022C6000-memory.dmp

memory/2872-8-0x00000000022E0000-0x00000000022E8000-memory.dmp

memory/2872-9-0x00000000022F0000-0x0000000002300000-memory.dmp

memory/2872-10-0x0000000002300000-0x000000000230A000-memory.dmp

memory/2872-11-0x000000001AF20000-0x000000001AF76000-memory.dmp

memory/2872-12-0x000000001A820000-0x000000001A82C000-memory.dmp

memory/2872-13-0x000000001A830000-0x000000001A838000-memory.dmp

memory/2872-14-0x000000001A840000-0x000000001A84C000-memory.dmp

memory/2872-15-0x000000001A850000-0x000000001A862000-memory.dmp

memory/2872-16-0x000000001A980000-0x000000001A988000-memory.dmp

memory/2872-17-0x000000001A990000-0x000000001A998000-memory.dmp

memory/2872-19-0x000000001AED0000-0x000000001AEDE000-memory.dmp

memory/2872-18-0x000000001AEC0000-0x000000001AECA000-memory.dmp

memory/2872-20-0x000000001AF70000-0x000000001AF78000-memory.dmp

memory/2872-21-0x000000001AF80000-0x000000001AF8E000-memory.dmp

memory/2872-22-0x000000001AF90000-0x000000001AF9C000-memory.dmp

memory/2872-23-0x000000001AFA0000-0x000000001AFA8000-memory.dmp

memory/2872-24-0x000000001AFB0000-0x000000001AFBA000-memory.dmp

memory/2872-25-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe

MD5 e349210264df2c9c8513e938aa1f3940
SHA1 e689f7221e0954c75e760d5103723c021b82eebb
SHA256 4d520afba4c682d393f2979de1abea0e96ec9f84f2b1d0164b57eea4eea15175
SHA512 93fb466f6a853c227ebf88ed5586d509e4982f6b0c6e6dce7343c38e887a5c5e5f9b3484d70c7d64b3bdff50a2a93bb73ce7e6a4f6eb4ee8960052248db08b99

C:\Windows\Resources\csrss.exe

MD5 aca376d1fbbdae37ac12118021977309
SHA1 a582a859522127e76a84c662eb45f2e183ae9a2a
SHA256 6b3049abaf104e0347b315c6aaf50b806afc2d6f3fd8874df9bda232397cf5a0
SHA512 e23eeb47146cf2ecf66953e13d20e87c638e6115a2d41ebfecc2cecbc207ae5fbe1b70f9d2e039005988d1cf875216e63b2d64dec0adf7086e9c23886ab4743f

memory/2872-124-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ca2b20db3ee39ff237186048ba77e8df
SHA1 408480acaea807a294c0937355205f565e83e860
SHA256 82794cae42f2af66c6cc110553a08e14289de93fb03d67d8163822ea39ef9dba
SHA512 8197bf3c2b13e2d2800aa184a02207b34f70df7cbcbbd8dc975ea01aaa9aaba1e599f06f7addf86faed357a1917272a8d4ab2fb28406ea1c58b8d7832f9de1d9

memory/1484-131-0x0000000000490000-0x0000000000498000-memory.dmp

memory/1484-130-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5aHV7JTKGb.bat

MD5 08ca394f19216c4072e53eb9bfe4b206
SHA1 88db3ce7a2b632791e3e2e5383123735d2df7c33
SHA256 c7b3c9421de28399ac365496ab4bc5ccfeddc670eeaa5b3c5017526453fd6306
SHA512 69c726cab8843d9a6161646376c2a051399574c88c5a3dd3849f577e23bcd6eef1756342f7eec62940b3e2282f49348d01c5756973b167f7dfed97ed0dd4e36c

memory/2920-184-0x0000000000D80000-0x0000000001066000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\88d6643c-1c32-4cb2-ac5c-835ca516018b.vbs

MD5 5f1da4466d26e59e6fd6f182ab8575c3
SHA1 7f77ff9ebbeff22d7cda63ca304282c28678a7c2
SHA256 3b4cb4a90c6c89ca58c966a7f0b8b5a13218ca0c970aec3dea2cc00942bcd24a
SHA512 e1362fad0b9d2dd0c9f9f0bd69b35608891df562d420267d298a68b0ef685bec5b9b76883b20e026dcf6cf0e1b837a63051fbf877aac3deb9b21084a1e92366f

C:\Users\Admin\AppData\Local\Temp\91a01db5-f4c4-4eb2-814d-3764b79dcf51.vbs

MD5 1ab79a3abbdb0a16f048f0dbfdc3df8c
SHA1 ed0ad2389a4f19c81b1a576393d38909217753fa
SHA256 782662a94ee2807770376c09a058efb40be59a7f7fa134c6d3d74ba32c21db06
SHA512 5ff33b05d55dab21e737692dd0285ccb595a735511723dec61a134ded904c9adc08ae9aa655641f911c2e57ca3e1f9dffc1fd0a22fb371e3875ddcf1e131b931

memory/1128-195-0x0000000001330000-0x0000000001616000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5c5f9120-874d-4592-adf9-28dad0f4f728.vbs

MD5 d727d46a2792a7cbdac8d69bce2c93be
SHA1 15108b49429efe4b21b33ce23622bd57f70561db
SHA256 b175f49088d915951258badd4ea30e3f810179ab119e0a955c43bdb560e55844
SHA512 4b0261e9f619837439c556b85aad825a5f2346aa1b741840045f231b4ee3f55e173eabd74978e4b24c60674104d2899cc6f11f3958ecd29233c3d4701bbaee12

memory/892-207-0x0000000000D10000-0x0000000000D66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0691a621-351c-4329-a175-6ff3e0e6cb75.vbs

MD5 ae55e56d74343b28ed5c5a57f8c59dcf
SHA1 4b311279fc5f5a89295fec16718ac286a712719a
SHA256 d72506ab3a8d09edfad22e5c74966c7a0056ebb1e4f4d873fc6d16e621478502
SHA512 9d2913c518d2c075ef0bd9bc383c538076a7bfc28257596655fb1f084292b5d6cacf85d567f9607bb5f800d547be5cdd22886260839a6df022d4e9a94beeaa39

memory/1348-219-0x0000000000090000-0x0000000000376000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5c75006b-6bf2-4c39-af40-b75eedf8863f.vbs

MD5 98ccd5bab3ad4e25b8c60db7dc3d68eb
SHA1 6200c6b686a32ae40e8c0038bca0bd597adfae25
SHA256 56e7344230028884641f23dca3d289c5658b9078c3133b5dced372ce853528d9
SHA512 e8c8052eeba3ae0a98a3ab81a25c48756e82250aceacb8cc63b8f5f9e655a5d846d1ff98b9e458cd9d4095f6522cdb298bb9b44b0732748ac65d32b07b167a9d

memory/952-231-0x0000000000BF0000-0x0000000000ED6000-memory.dmp

memory/952-232-0x0000000002490000-0x00000000024A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d777272d-2e32-4c3b-9479-5c54a82d058b.vbs

MD5 81e565bfcf432f83b4b5823a98cb522c
SHA1 a8f0460c7514243b0b157dcaf8cabf0bca7592b7
SHA256 7b2f236f13b78e3cb07d404efab5163f4234b5cb3ac9288bcc4af5c0036a9927
SHA512 33cb99e5b087bbfa6871e7a99420b7a588ed5dc23dd22184731f9760b7c7ad361adf4297b2877d5c911aacc3783ac1d8c3942844c7ff7229f210dafec0b10acf

memory/2724-244-0x0000000001190000-0x0000000001476000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d98a413e-6e9e-4ac8-8e39-c09a15ff1e0f.vbs

MD5 d59c51b0fecd913e4c9f43ff46002fdc
SHA1 abaa3d041bfe582f967a644e7cffb159961225d8
SHA256 b40ad32fc79fed0d975c94ac93678b6cd752d2dc40a20cf003543ba8601017ca
SHA512 0548aaf9c0f3b05f1f30f29d00905dbaca513aa4fc3809b4ade4be2b61734eb214ef4b705676cc86b709a5d8490c6ef1ca89cb5c4c09bdcdfe047a65178cea03

C:\Users\Admin\AppData\Local\Temp\36e9956a-823e-4fc7-83e6-650a72d7fe55.vbs

MD5 9892efb9aac788bfc2be912e35b34a3a
SHA1 e4d03117331b725d46e70f68a40c688f161a29da
SHA256 51f8b6b7416037646748ec44eadf00dfedf0f6299b0ee809f2f191329b0e780e
SHA512 33d799664ac0e0b6b799f1e755c09d6a83fe7378f1e94abcf88f76c7e27e29ffe93cf930509abc9e072b3f27d05255f8beba1e1a1f8e5cdad908adaea40da7c9

memory/2548-267-0x00000000000E0000-0x00000000003C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4ac724b0-6d26-4e2c-803d-fee9a339a226.vbs

MD5 767097a56fb53c8bd7c82c81ecadf80c
SHA1 b1c46b104479e1624fc722c72d4d61eac5414042
SHA256 38f2a229dc9a36a017804d7048d75c912cf7f15f80658d2c69681782014874ef
SHA512 c0ad1b9a094310ffe3524ab01451c747eb17b607420ed60f4b708a03ab94a8f573f52f9b4745b34352d558dc292c785188c7d7b5bedf0bcf8f11370d88d88abe

memory/3000-279-0x00000000000F0000-0x00000000003D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\eea7e8ad-dafe-4f5a-9f3a-35850fda8351.vbs

MD5 47b74c448fb3e6b4495b8f0583de62c3
SHA1 7e78213c03db78aad93d8d6c5fdbbd8ce3152d86
SHA256 745bf75519064ddbc0e6d97b162ca8e4dbdc2e46cfb06b42a96b361fe9280517
SHA512 9dc130bb31825f8f2c53aef67f3eba0b10ef1169b737a544db1e48754d3bc27f6d5e73ffe340589f9c6e53559a5c3c37e35da7d9d8dd9f985d644afea713c229

memory/2988-291-0x0000000000110000-0x00000000003F6000-memory.dmp

memory/2988-292-0x0000000002470000-0x0000000002482000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9a057145-b7a3-4298-80db-9d12830dc7ee.vbs

MD5 d524d0d59de7558afb656aafe6ed0336
SHA1 23b820e3d30c6d872e893648079ec7fcc21c838d
SHA256 b3bbba763cd17a5c3a2112dc61a0024973dd2ea789e12bc457acadfd25530acd
SHA512 7c90f6611f5fd4a95502f05949f49cf3143b333d0798aa45003043e37b4b4fffdfac87df4f1a690289b6f6c8d2f6df3923ac8b35fd64950a8e4f3cc541b4e2c0

memory/1748-304-0x0000000000990000-0x00000000009A2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 15:29

Reported

2024-05-16 15:32

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\TextInputHost.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCX6063.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\TextInputHost.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\121e5b5079f7c0 C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\lsass.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\ja-JP\e6c9b481da804f C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\lsass.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ee2ad38f3d4382 C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\6203df4a6bafc7 C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\RCX5E3F.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\22eafd247d37c3 C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCX5C2B.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\RCX6277.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\RCX669F.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\PrintDialog\en-US\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Windows\CbsTemp\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File created C:\Windows\CbsTemp\f3b6ecef712a24 C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\CbsTemp\RCX648B.tmp C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\CbsTemp\spoolsv.exe C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
N/A N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 692 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 4020 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 692 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 692 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1116 wrote to memory of 4768 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1116 wrote to memory of 4768 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1116 wrote to memory of 4748 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 1116 wrote to memory of 4748 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 4748 wrote to memory of 2060 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4748 wrote to memory of 2060 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4748 wrote to memory of 4240 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4748 wrote to memory of 4240 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 2060 wrote to memory of 4992 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 2060 wrote to memory of 4992 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 4992 wrote to memory of 3388 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4992 wrote to memory of 3388 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4992 wrote to memory of 4424 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4992 wrote to memory of 4424 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 3388 wrote to memory of 2484 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 3388 wrote to memory of 2484 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 2484 wrote to memory of 4364 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 2484 wrote to memory of 4364 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 2484 wrote to memory of 696 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 2484 wrote to memory of 696 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4364 wrote to memory of 4712 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 4364 wrote to memory of 4712 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 4712 wrote to memory of 4720 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4712 wrote to memory of 4720 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4712 wrote to memory of 60 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4712 wrote to memory of 60 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4720 wrote to memory of 1368 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 4720 wrote to memory of 1368 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 1368 wrote to memory of 3180 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 1368 wrote to memory of 3180 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 1368 wrote to memory of 4060 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 1368 wrote to memory of 4060 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 3180 wrote to memory of 4444 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 3180 wrote to memory of 4444 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 4444 wrote to memory of 3804 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4444 wrote to memory of 3804 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4444 wrote to memory of 3352 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 4444 wrote to memory of 3352 N/A C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe C:\Windows\System32\WScript.exe
PID 3804 wrote to memory of 3388 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe
PID 3804 wrote to memory of 3388 N/A C:\Windows\System32\WScript.exe C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\e349210264df2c9c8513e938aa1f3940_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\CbsTemp\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\CbsTemp\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Favorites\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qh9VekMcNe.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82c33a76-482b-4c63-b143-e906d9dc6fe9.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87077c02-db44-4ed0-b582-4843dd4c22e0.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f934632b-0b62-4e0f-81b3-1bfa77017b2d.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02a72462-e69d-499f-80d5-56639959363a.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b130ef7-7610-49a4-b9a4-f26cd85fc60d.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c3ed728-c385-4e4b-9556-776a37a4c3ae.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\929593c7-7000-4505-945d-a32b494fcb43.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f550c0ee-1727-49ab-9a77-a6f39310f549.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f69558bf-b4d3-47ea-bf0f-a48954c2739f.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\087ce2d6-11da-4cd1-9dfb-8c66ac19bd04.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32e09c32-50c5-48cd-807a-6c69ffa2e2e5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8f46b37-6c17-4c7d-9fdd-4fcb84107481.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20cfcbef-b0b9-4922-a83f-5968c6a5a53b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0d48346-e6ce-4386-9f22-c2a5474ccb6d.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2355dd4d-d008-4794-980d-fcaccb0761d6.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4403b37b-7848-4851-9e64-faa24d259bdc.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a310182-8dc8-4d0a-b40b-7f2807d65bf5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\389e1f54-8c01-4226-a20d-bd1f7962d505.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1756601-a560-4f71-8143-1c3a32fadff4.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c209b46a-cac2-48b2-b1db-128bb1fb1392.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0d43544-f15a-4545-ac4a-68648888ff72.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44e7def4-9403-4204-ba6a-5b7edfab2864.vbs"

C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe

"C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14fd738e-2af5-4917-9cc7-996ceec93925.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e208bf7-498d-4623-8aa3-381864b29166.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.104:443 www.bing.com tcp
US 8.8.8.8:53 104.61.62.23.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
US 8.8.8.8:53 247.68.154.149.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp
RU 149.154.68.247:80 149.154.68.247 tcp

Files

memory/692-0-0x00007FF96E2F3000-0x00007FF96E2F5000-memory.dmp

memory/692-1-0x0000000000790000-0x0000000000A76000-memory.dmp

memory/692-2-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp

memory/692-3-0x0000000001290000-0x00000000012AC000-memory.dmp

memory/692-4-0x000000001B600000-0x000000001B650000-memory.dmp

memory/692-6-0x000000001B5B0000-0x000000001B5C0000-memory.dmp

memory/692-8-0x000000001B5E0000-0x000000001B5E8000-memory.dmp

memory/692-7-0x000000001B5C0000-0x000000001B5D6000-memory.dmp

memory/692-5-0x00000000012C0000-0x00000000012C8000-memory.dmp

memory/692-9-0x000000001B5F0000-0x000000001B5F8000-memory.dmp

memory/692-10-0x000000001B650000-0x000000001B660000-memory.dmp

memory/692-11-0x000000001BD70000-0x000000001BD7A000-memory.dmp

memory/692-12-0x000000001BD80000-0x000000001BDD6000-memory.dmp

memory/692-13-0x000000001BDD0000-0x000000001BDDC000-memory.dmp

memory/692-14-0x000000001BDE0000-0x000000001BDE8000-memory.dmp

memory/692-15-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

memory/692-16-0x000000001BE00000-0x000000001BE12000-memory.dmp

memory/692-17-0x000000001C360000-0x000000001C888000-memory.dmp

memory/692-23-0x000000001BE80000-0x000000001BE8E000-memory.dmp

memory/692-22-0x000000001BE70000-0x000000001BE78000-memory.dmp

memory/692-21-0x000000001BE60000-0x000000001BE6E000-memory.dmp

memory/692-26-0x000000001BEB0000-0x000000001BEBA000-memory.dmp

memory/692-27-0x000000001BEC0000-0x000000001BECC000-memory.dmp

memory/692-25-0x000000001BEA0000-0x000000001BEA8000-memory.dmp

memory/692-24-0x000000001BE90000-0x000000001BE9C000-memory.dmp

memory/692-20-0x000000001BE50000-0x000000001BE5A000-memory.dmp

memory/692-19-0x000000001BE40000-0x000000001BE48000-memory.dmp

memory/692-18-0x000000001BE30000-0x000000001BE38000-memory.dmp

C:\Windows\CbsTemp\spoolsv.exe

MD5 e349210264df2c9c8513e938aa1f3940
SHA1 e689f7221e0954c75e760d5103723c021b82eebb
SHA256 4d520afba4c682d393f2979de1abea0e96ec9f84f2b1d0164b57eea4eea15175
SHA512 93fb466f6a853c227ebf88ed5586d509e4982f6b0c6e6dce7343c38e887a5c5e5f9b3484d70c7d64b3bdff50a2a93bb73ce7e6a4f6eb4ee8960052248db08b99

memory/1184-115-0x000001F654D60000-0x000001F654D82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yuovahwq.sx5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/692-144-0x00007FF96E2F0000-0x00007FF96EDB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Qh9VekMcNe.bat

MD5 6e0ebe415999694bbe357fa8991f4bab
SHA1 a5386711f5ab6e5d075d3915fb157209c9b65b6c
SHA256 cfa1b6b05286f53b7d7bf9b96e4385121394b732ed036bf85ee6889a426be208
SHA512 25cee9ce0175ac36452feffabb213bf40e29586f3b7a814824783c30ccaa01b12ac20bd6865a1e5cf6f8278ef20a681d9d331c3f83f244188e1b9c572410d3bf

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6c47b3f4e68eebd47e9332eebfd2dd4e
SHA1 67f0b143336d7db7b281ed3de5e877fa87261834
SHA256 8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA512 0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

memory/4748-224-0x000000001B420000-0x000000001B432000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\82c33a76-482b-4c63-b143-e906d9dc6fe9.vbs

MD5 ce0e315967750f876e2667ca3d37e49e
SHA1 d75a8b47314283f9303a43ba03b3db269797ddd7
SHA256 72527636f5a9c6209da1da9cc2f8194aecf43abd8a81fc9e7a56663f99db6e44
SHA512 5436c07bce7e1ac27293230deb53933478c5a6be05c763d6617381a82693d65fe9c33627a1c313cad155a6b9d934931382c50943e568f870fb470215fffbc986

C:\Users\Admin\AppData\Local\Temp\87077c02-db44-4ed0-b582-4843dd4c22e0.vbs

MD5 bb4228689ebea737374b7e36c4a7d5af
SHA1 dfb2a19c0f12006346b96af27824055f2f65e01e
SHA256 1e4d35ef75b6e830e2e04f1ee8c1cc830c895c45d9cd57ad04673115cda6794a
SHA512 7576431b9d8abb7ff78ea3340b08e1efd10fce2bfe5cbd3bf59e1d1056d66379be6bc3e4a3e503f7bbcb0af2d15683fc6fdca27de935e70b8e1d65c2d3805109

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

C:\Users\Admin\AppData\Local\Temp\f934632b-0b62-4e0f-81b3-1bfa77017b2d.vbs

MD5 4972953e4daec1fbe4845e5ff954a3f2
SHA1 64fbd6bfc5cbf86150ae6a71038dc973f6ef1bf2
SHA256 1f3cce9be14f8d0234fe7b522b27007524b263bc53ff026cddb70375e501575b
SHA512 d974ef204fe71d0823f1762956f6c5afe2f1b9192e1d926f75e63386b3c4694235919478fc8402d1f2bcfae0a19e34262d84ad69017ffe9d4935c284ab50c3fe

memory/2484-248-0x0000000003570000-0x0000000003582000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2b130ef7-7610-49a4-b9a4-f26cd85fc60d.vbs

MD5 0905cf14886f5dd9d767bf59a55c8c12
SHA1 0fc7187df619d98caea83bec3efb7379a6cdcdf6
SHA256 b971ea34f6c6499be177c5a7e39c3badd0baf35361e59559244b1ed3c431a5a4
SHA512 b1371b4193ee62523c59bef47940cd3d2a6a49a0e06c0ef8418a1ab7886e7a71fc1edff48d6b4d3ca82f7ab218f3f9f84f6d2c432f6e1b4369aa4dcad632e9d8

memory/4712-260-0x000000001BCC0000-0x000000001BCD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\929593c7-7000-4505-945d-a32b494fcb43.vbs

MD5 e9054c8dce0d994c6403c439868f6868
SHA1 38fc5b338254b5689cf5a2f8cedb621d7a5958da
SHA256 6da67460a852aae899862de169e593145bac43e76fa3c77368fab103844839b5
SHA512 b17b6ecc01945655226b1249c97e1edef67cc1a23dbbfde4019e1c2365f77813ae8305ff0b6e54bb2e588cddd5aeb9126403c6b38f5712e9b9be44366d89b379

C:\Users\Admin\AppData\Local\Temp\f69558bf-b4d3-47ea-bf0f-a48954c2739f.vbs

MD5 9f7280b4049981e75d8c208152724825
SHA1 e4d3c72188c4ee9d82e2f5262fdf4433b2268d1d
SHA256 8d85d13ab52a1f698b0380d16e4cbacce5c801e3377cb55b898d4966daf2d15f
SHA512 a9ceb86899a7879ab55daf90a9d0a73a0a01603e989bba9c1699ab1bbd2ae8aa73b4ba0d8d6abb7db82e6a2e7e2560ea66fff165736675023693a642861c429f

C:\Users\Admin\AppData\Local\Temp\32e09c32-50c5-48cd-807a-6c69ffa2e2e5.vbs

MD5 45ca9e0a46f54715d8bddf9953101b76
SHA1 2f89b4ee5e558e6662894cad40b6d7eb3eb1fdca
SHA256 2aa5dbbfe0cd32f6f0adc60701140469d56420cd26dca63c02743926eaadab22
SHA512 fef18414fd58374c6e07a50e6fa8cc36be1504d04466a94285c8b09e9efef0f5de80446d9c698bd785e5aee39d4a8914b43a8ee0f098330383e289d79e7cccab

C:\Users\Admin\AppData\Local\Temp\20cfcbef-b0b9-4922-a83f-5968c6a5a53b.vbs

MD5 4f41603579adccf749d9ff9cac438f2b
SHA1 1450a9b8b11f50c9c11f90c7e3844e37f77d272d
SHA256 931ccf0ce36de9d87124c4435dc03a387bc3bee8390abd8ffbdf98015c43445d
SHA512 57740bb93f9214a91a95de18fcc7880197318095da05c3bdaa7346ddedc91971b68840deea3ceddf252cf5b360d9c2b0b0c39484b2de3c8d1b93c8d2b1704ce4

C:\Users\Admin\AppData\Local\Temp\2355dd4d-d008-4794-980d-fcaccb0761d6.vbs

MD5 cfdab03a143935d5374bba3bdd6cbfa9
SHA1 a13f9e3f36f4bb90edc74982330e5d9d81edf6d4
SHA256 38c0082d0de158b71fc543bcc54ec07c595bd0e7d7a7b657041d986e2bbc6168
SHA512 6268361c2846d14dc8a1c7054687518f751358d9418b3b733929614ab8c344fa302132ffbcfe79cc44396f52134804a259ced22ba2ac8a2c2fcf221a4c7d1227

C:\Users\Admin\AppData\Local\Temp\2a310182-8dc8-4d0a-b40b-7f2807d65bf5.vbs

MD5 96d057046655bc6099ea584cde5ffe05
SHA1 5128eaca2cd0317b6e209e539393072be91190bf
SHA256 0fbcc08b7d91ce47e02bec9be9f2bdc53ca87da0c555eb1f24f5bd15e09109d7
SHA512 ee1f95ac0a2005c834e1fbc376f37bf85e1cf88f6ccfb93629dd05e467e45c7ec845eed771c2c02868942804d4ee22b71c80ce67e21ef8f2305af4b23a1661df

C:\Users\Admin\AppData\Local\Temp\b1756601-a560-4f71-8143-1c3a32fadff4.vbs

MD5 69f508203a60a3c2c501a9a4147261ec
SHA1 dfb3cc635429c9461208a308fca065b9568b4fb7
SHA256 76567dd78bb3416bee660ae8915ede2db304c1e02ca6b2c5da8ac82918f4dd37
SHA512 8c5271ba0c34a761595152f3570d90f25a34defa96e16e9a2b2c7ba5c212bb54ea3c7f689acc25ab52738bc625b1ed97a7f83a4440e47a4300e8d4e555d1285f

C:\Users\Admin\AppData\Local\Temp\f0d43544-f15a-4545-ac4a-68648888ff72.vbs

MD5 7019c242f079b5ea6084820455a3c6eb
SHA1 eb3af486b229be0f70db50b79c9113bcff294add
SHA256 64a35813660b45ba967479acd08bdab8bff44533d50590be0c88450b7625c6a8
SHA512 e17cc96935837c8fe44cb5f331941427367bdaaf48410582a86643df7cb46315e36ac917a76a0c24495f55fde826232783a080851c4ac92da6228e8463469714

memory/4908-349-0x0000000002E20000-0x0000000002E32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\14fd738e-2af5-4917-9cc7-996ceec93925.vbs

MD5 949988c59b1d7406bd0971d1901c0619
SHA1 bea740a721dbce97d6e06b7f4ee40718287b83a5
SHA256 a864f3794608f725d27f2d75ce350994eafd9e6c7bc421f02ef25713f329d87c
SHA512 496145823b91b4b50ad1107b7350bce16c9e2b3ba3503b8c613f0b668299229f16fcc7cd5360131902a1493e79fb1de68e388f368fa90237ddfb16b55cdc97ec