Analysis
-
max time kernel
115s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll
-
Size
120KB
-
MD5
8ff67929e46a15f64fc0e27cdfba6920
-
SHA1
312b802657d5214e37a63c7d5d5305d15432b3da
-
SHA256
bfdf454da76a7a7d3e7fa6743867668c7862b53fff6f67f3adc82fcd14406d98
-
SHA512
ae35ddb9809d19af839636b9bf08b67fade445456c6946c5676cc6741595fe5280749e39513e0f48f433c97da0c149255c49eb143b037dd3b178af7a75c5b06c
-
SSDEEP
3072:kXLY9+q+jwOMe9Xk4imY/b38blC+Kvmh7S:kYb2My8/b8bleOh7S
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e5776e5.exee575091.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575091.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575091.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575091.exe -
Processes:
e575091.exee5776e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5776e5.exe -
Processes:
e575091.exee5776e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5776e5.exe -
Executes dropped EXE 3 IoCs
Processes:
e575091.exee57516c.exee5776e5.exepid process 3212 e575091.exe 2372 e57516c.exe 3720 e5776e5.exe -
Processes:
resource yara_rule behavioral2/memory/3212-6-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-11-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-30-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-25-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-12-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-10-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-9-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-26-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-34-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-35-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-36-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-37-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-38-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-39-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-40-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-58-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-59-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-60-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-61-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-64-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-65-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-67-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-70-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-71-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-73-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3212-75-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3720-110-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/3720-146-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Processes:
e575091.exee5776e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575091.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5776e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5776e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5776e5.exe -
Processes:
e575091.exee5776e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5776e5.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e575091.exee5776e5.exedescription ioc process File opened (read-only) \??\L: e575091.exe File opened (read-only) \??\M: e575091.exe File opened (read-only) \??\E: e5776e5.exe File opened (read-only) \??\J: e575091.exe File opened (read-only) \??\K: e575091.exe File opened (read-only) \??\I: e575091.exe File opened (read-only) \??\O: e575091.exe File opened (read-only) \??\I: e5776e5.exe File opened (read-only) \??\G: e575091.exe File opened (read-only) \??\H: e575091.exe File opened (read-only) \??\G: e5776e5.exe File opened (read-only) \??\H: e5776e5.exe File opened (read-only) \??\E: e575091.exe File opened (read-only) \??\N: e575091.exe -
Drops file in Windows directory 3 IoCs
Processes:
e575091.exee5776e5.exedescription ioc process File created C:\Windows\e5750cf e575091.exe File opened for modification C:\Windows\SYSTEM.INI e575091.exe File created C:\Windows\e57a141 e5776e5.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e575091.exee5776e5.exepid process 3212 e575091.exe 3212 e575091.exe 3212 e575091.exe 3212 e575091.exe 3720 e5776e5.exe 3720 e5776e5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e575091.exedescription pid process Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe Token: SeDebugPrivilege 3212 e575091.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee575091.exee5776e5.exedescription pid process target process PID 4572 wrote to memory of 1804 4572 rundll32.exe rundll32.exe PID 4572 wrote to memory of 1804 4572 rundll32.exe rundll32.exe PID 4572 wrote to memory of 1804 4572 rundll32.exe rundll32.exe PID 1804 wrote to memory of 3212 1804 rundll32.exe e575091.exe PID 1804 wrote to memory of 3212 1804 rundll32.exe e575091.exe PID 1804 wrote to memory of 3212 1804 rundll32.exe e575091.exe PID 3212 wrote to memory of 784 3212 e575091.exe fontdrvhost.exe PID 3212 wrote to memory of 792 3212 e575091.exe fontdrvhost.exe PID 3212 wrote to memory of 1020 3212 e575091.exe dwm.exe PID 3212 wrote to memory of 2580 3212 e575091.exe sihost.exe PID 3212 wrote to memory of 2592 3212 e575091.exe svchost.exe PID 3212 wrote to memory of 2900 3212 e575091.exe taskhostw.exe PID 3212 wrote to memory of 3556 3212 e575091.exe Explorer.EXE PID 3212 wrote to memory of 3672 3212 e575091.exe svchost.exe PID 3212 wrote to memory of 3864 3212 e575091.exe DllHost.exe PID 3212 wrote to memory of 3988 3212 e575091.exe StartMenuExperienceHost.exe PID 3212 wrote to memory of 4052 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 688 3212 e575091.exe SearchApp.exe PID 3212 wrote to memory of 4120 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 4376 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 3856 3212 e575091.exe TextInputHost.exe PID 3212 wrote to memory of 4204 3212 e575091.exe backgroundTaskHost.exe PID 3212 wrote to memory of 3640 3212 e575091.exe backgroundTaskHost.exe PID 3212 wrote to memory of 4572 3212 e575091.exe rundll32.exe PID 3212 wrote to memory of 1804 3212 e575091.exe rundll32.exe PID 3212 wrote to memory of 1804 3212 e575091.exe rundll32.exe PID 1804 wrote to memory of 2372 1804 rundll32.exe e57516c.exe PID 1804 wrote to memory of 2372 1804 rundll32.exe e57516c.exe PID 1804 wrote to memory of 2372 1804 rundll32.exe e57516c.exe PID 1804 wrote to memory of 3720 1804 rundll32.exe e5776e5.exe PID 1804 wrote to memory of 3720 1804 rundll32.exe e5776e5.exe PID 1804 wrote to memory of 3720 1804 rundll32.exe e5776e5.exe PID 3212 wrote to memory of 784 3212 e575091.exe fontdrvhost.exe PID 3212 wrote to memory of 792 3212 e575091.exe fontdrvhost.exe PID 3212 wrote to memory of 1020 3212 e575091.exe dwm.exe PID 3212 wrote to memory of 2580 3212 e575091.exe sihost.exe PID 3212 wrote to memory of 2592 3212 e575091.exe svchost.exe PID 3212 wrote to memory of 2900 3212 e575091.exe taskhostw.exe PID 3212 wrote to memory of 3556 3212 e575091.exe Explorer.EXE PID 3212 wrote to memory of 3672 3212 e575091.exe svchost.exe PID 3212 wrote to memory of 3864 3212 e575091.exe DllHost.exe PID 3212 wrote to memory of 3988 3212 e575091.exe StartMenuExperienceHost.exe PID 3212 wrote to memory of 4052 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 688 3212 e575091.exe SearchApp.exe PID 3212 wrote to memory of 4120 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 4376 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 3856 3212 e575091.exe TextInputHost.exe PID 3212 wrote to memory of 4204 3212 e575091.exe backgroundTaskHost.exe PID 3212 wrote to memory of 3640 3212 e575091.exe backgroundTaskHost.exe PID 3212 wrote to memory of 2372 3212 e575091.exe e57516c.exe PID 3212 wrote to memory of 2372 3212 e575091.exe e57516c.exe PID 3212 wrote to memory of 3720 3212 e575091.exe e5776e5.exe PID 3212 wrote to memory of 3720 3212 e575091.exe e5776e5.exe PID 3212 wrote to memory of 2384 3212 e575091.exe BackgroundTaskHost.exe PID 3212 wrote to memory of 1596 3212 e575091.exe RuntimeBroker.exe PID 3212 wrote to memory of 1360 3212 e575091.exe RuntimeBroker.exe PID 3720 wrote to memory of 784 3720 e5776e5.exe fontdrvhost.exe PID 3720 wrote to memory of 792 3720 e5776e5.exe fontdrvhost.exe PID 3720 wrote to memory of 1020 3720 e5776e5.exe dwm.exe PID 3720 wrote to memory of 2580 3720 e5776e5.exe sihost.exe PID 3720 wrote to memory of 2592 3720 e5776e5.exe svchost.exe PID 3720 wrote to memory of 2900 3720 e5776e5.exe taskhostw.exe PID 3720 wrote to memory of 3556 3720 e5776e5.exe Explorer.EXE PID 3720 wrote to memory of 3672 3720 e5776e5.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e575091.exee5776e5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575091.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5776e5.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8ff67929e46a15f64fc0e27cdfba6920_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e575091.exeC:\Users\Admin\AppData\Local\Temp\e575091.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57516c.exeC:\Users\Admin\AppData\Local\Temp\e57516c.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e5776e5.exeC:\Users\Admin\AppData\Local\Temp\e5776e5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e575091.exeFilesize
97KB
MD5278884790aabd3eb232089eeaaad9e90
SHA15ae731393291452fcb56b6d81a58042a2a6104d8
SHA256d8b7db83000bb2a4a7a9372e4d8fb698c31dce6df8e7349db73fc71d6406f3ba
SHA512a1134f383a0caa85b7b3f4b32629158390e289e0e1063422084730d7cda2338b931bc39e221f0593579ac05e4ff129d4170b142258dfc0eb0bfc4bbca94e4c12
-
C:\Windows\SYSTEM.INIFilesize
257B
MD573605b1f9efbe4e3bac20310aaa90f87
SHA1ed1306656a6f65e7415573edfd24a021e079e986
SHA2563a3dec01284be9f38bd8cb5aa316ff4e3623cdca5b425f94680859aed2b58cab
SHA512afba86d9ababd4fd99d2bba08928cccf2941205b7f668d79b0fd05d22dee0a0653affde8a344322b8475212e525d82e565eaae51f8ce4035eaa4efd42373f4c2
-
memory/1804-14-0x00000000011B0000-0x00000000011B1000-memory.dmpFilesize
4KB
-
memory/1804-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1804-33-0x00000000011A0000-0x00000000011A2000-memory.dmpFilesize
8KB
-
memory/1804-17-0x00000000011A0000-0x00000000011A2000-memory.dmpFilesize
8KB
-
memory/1804-13-0x00000000011A0000-0x00000000011A2000-memory.dmpFilesize
8KB
-
memory/2372-32-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2372-98-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2372-56-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2372-54-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2372-51-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3212-39-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-71-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-12-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-25-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-10-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-9-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-26-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-34-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-35-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-36-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-37-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-38-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-30-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-40-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3212-6-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-31-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/3212-11-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-16-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/3212-94-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3212-58-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-59-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-60-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-61-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-64-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-65-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-67-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-70-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-27-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/3212-73-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-75-0x0000000000850000-0x000000000190A000-memory.dmpFilesize
16.7MB
-
memory/3212-84-0x00000000005F0000-0x00000000005F2000-memory.dmpFilesize
8KB
-
memory/3720-57-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3720-53-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3720-48-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3720-110-0x0000000000B50000-0x0000000001C0A000-memory.dmpFilesize
16.7MB
-
memory/3720-147-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3720-146-0x0000000000B50000-0x0000000001C0A000-memory.dmpFilesize
16.7MB