617e92659377c1b3ad840c40e63b6a9a4e3b4b4b3f59f8e4bacfaba3e56c957d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Size

831KB
MD5

0a1e2a8e985c7b1f74845e4bb71ecfe0
SHA1

1d6e833e9c345c12767481641066a7c08c3a6794
SHA256

617e92659377c1b3ad840c40e63b6a9a4e3b4b4b3f59f8e4bacfaba3e56c957d
SHA512

77049304f0b904cea8dd2dfde7c90a8e97fa1d7f7af665d934c6ef29b166f041eec4227e7c4f379b981bf66217c52100cf966144405755bde8bb26e33603b74a
SSDEEP

6144:nwynAtMrOVRkidy9yIGWlUiwS4O8b8ITDnlznZ0NP4w:nwKfOVRo9yRYn4O8b8ITDnlC94w

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1664	cagcat10microsoft.exe
600	systemsystem.exe
1696	sistematiptsf.exe
2304	microsoftmicrosoft.exe

Loads dropped DLL 4 IoCs

pid	Process
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MsoSVIntMicrosoft = "c:\\program files (x86)\\common files\\microsoft shared\\web folders\\1033\\msosvintoffice.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CagCat10Organizer = "c:\\program files (x86)\\microsoft office\\media\\cagcat10\\1033\\cagcat10microsoft.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OperatingWindows = "c:\\program files (x86)\\common files\\system\\ja-jp\\windowswindows.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\HXDSUIMicrosoft2.05.50727.4039 = "c:\\program files (x86)\\common files\\microsoft shared\\help\\1046\\microsoftmicrosoft.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\OperatingWindows = "c:\\program files (x86)\\common files\\microsoft shared\\ink\\en-us\\systemsystem.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\operativooperativo = "c:\\program files (x86)\\common files\\microsoft shared\\ink\\es-es\\sistematiptsf.exe"	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntdll.dll.dll	cagcat10microsoft.exe
File created	C:\Windows\SysWOW64\ntdll.dll.dll	systemsystem.exe
File created	C:\Windows\SysWOW64\ntdll.dll.dll	sistematiptsf.exe
File created	C:\Windows\SysWOW64\ntdll.dll.dll	microsoftmicrosoft.exe
File created	C:\Windows\SysWOW64\ntdll.dll.dll	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\ja-JP\WindowsWindows.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\SistemaTipTsf.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\RCX1DDE.tmp	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\MSOSVINTOffice.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\RCX3391.tmp	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\MicrosoftMicrosoft.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\RCX33B2.tmp	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ja-JP\RCX33B3.tmp	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\SistemaTipTsf.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\CagCat10Microsoft.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\RCX1DCD.tmp	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\RCX1DDF.tmp	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\SystemSystem.exe	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cagcat10microsoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	sistematiptsf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cagcat10microsoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	systemsystem.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	systemsystem.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sistematiptsf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	microsoftmicrosoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	cagcat10microsoft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	systemsystem.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sistematiptsf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	microsoftmicrosoft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	microsoftmicrosoft.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1664	cagcat10microsoft.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
600	systemsystem.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1696	sistematiptsf.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
2304	microsoftmicrosoft.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 1664	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 600	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1696	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2304	1712	0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe	35

C:\Users\Admin\AppData\Local\Temp\0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a1e2a8e985c7b1f74845e4bb71ecfe0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712
- \??\c:\program files (x86)\microsoft office\media\cagcat10\1033\cagcat10microsoft.exe
  "c:\program files (x86)\microsoft office\media\cagcat10\1033\cagcat10microsoft.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- \??\c:\program files (x86)\common files\microsoft shared\ink\en-us\systemsystem.exe
  "c:\program files (x86)\common files\microsoft shared\ink\en-us\systemsystem.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:600
- \??\c:\program files (x86)\common files\microsoft shared\ink\es-es\sistematiptsf.exe
  "c:\program files (x86)\common files\microsoft shared\ink\es-es\sistematiptsf.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- \??\c:\program files (x86)\common files\microsoft shared\help\1046\microsoftmicrosoft.exe
  "c:\program files (x86)\common files\microsoft shared\help\1046\microsoftmicrosoft.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\RCX1DDF.tmp

Filesize
832KB

MD5
41004c921766097233197137b1b0a380

SHA1
2add27759455450bbc90e544b67e026fec13bb60

SHA256
0b897d0b226c4211a02e96afa056f84778c664d7ffc082a54cdc6c07a0d1ec9e

SHA512
a9793036532cb93eee575950e560a973079f4c9da7d65afc7a1a053a077b6ffd4871e03e66c517aeb2818017c504bc0abbd255b509eadb384589690904e649f7

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\SistemaTipTsf.exe

Filesize
831KB

MD5
0a1e2a8e985c7b1f74845e4bb71ecfe0

SHA1
1d6e833e9c345c12767481641066a7c08c3a6794

SHA256
617e92659377c1b3ad840c40e63b6a9a4e3b4b4b3f59f8e4bacfaba3e56c957d

SHA512
77049304f0b904cea8dd2dfde7c90a8e97fa1d7f7af665d934c6ef29b166f041eec4227e7c4f379b981bf66217c52100cf966144405755bde8bb26e33603b74a

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1046\MicrosoftMicrosoft.exe

Filesize
832KB

MD5
2d814233f182e6da56475171e5f3e762

SHA1
a20def6a452bf99f7fe7b6b451eb802cf6b50b2b

SHA256
f4f24d2e719db5ac145f87cca3b72d165c4674c3a61851580c428bf29ee75b0e

SHA512
88d1615c3d2a1f01edce36698e632bb3559817cdcba39cdf08a9cad6f3a71ddfc22645db0b463e543b542026acb37edd0b793ad46e14653d041fc1a42ec00098

Download Submit
\Program Files (x86)\Common Files\microsoft shared\ink\en-US\SystemSystem.exe

Filesize
832KB

MD5
cf1d967995d514fb3a446a023b3e6ada

SHA1
84e43b2bdbd3ec67fdd428b8007cf75c7e30780e

SHA256
b8804b603102f898358ab1b7fe6ea7fa9e69c3dfc78c84fcfc2eb3c6a69d1300

SHA512
55a1f655d11252fab7de0dcd962581cf78abfb0d259067291eb8694e104793c0e7b4ca318d80fb3c82081036a5d9e76f58f74665209a770d2921554a2ae966fb

Download Submit