Analysis
-
max time kernel
136s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll
-
Size
120KB
-
MD5
19ffaf791aa6e33bac356d6245e7f680
-
SHA1
b65490b77e174fdaf37321750de44719de3dd5df
-
SHA256
78a18a2d1ed4460c7c1cddfd81d023691d1fd1f57069eb605c765071ec17ba67
-
SHA512
c9796f2411a5511b676079fa1236e90565a33e7c0bd2e3a3f2dba463685eb127b84a1f306562261f172922df93713d11c6ad444d975554b3b686f33d441da0e0
-
SSDEEP
1536:ivkltltUCsdydraA0pHGErBzNbea6R5LH2uvIvES+avbuO+/TiQWFjYf4GO:QkhtURygXHpBzNbeFydEgeiQWFj5G
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e57471b.exee5762c1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57471b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57471b.exe -
Processes:
e57471b.exee5762c1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5762c1.exe -
Processes:
e5762c1.exee57471b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57471b.exe -
Executes dropped EXE 3 IoCs
Processes:
e57471b.exee574882.exee5762c1.exepid process 4452 e57471b.exe 3052 e574882.exe 2732 e5762c1.exe -
Processes:
resource yara_rule behavioral2/memory/4452-6-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-11-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-10-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-28-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-27-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-34-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-18-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-12-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-9-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-19-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-8-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-37-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-36-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-38-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-39-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-40-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-42-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-43-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-52-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-54-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-55-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-65-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-67-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-70-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-72-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-73-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-74-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-76-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-78-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-80-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-82-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4452-85-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2732-123-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/2732-150-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Processes:
e57471b.exee5762c1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57471b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57471b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5762c1.exe -
Processes:
e57471b.exee5762c1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57471b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5762c1.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e57471b.exee5762c1.exedescription ioc process File opened (read-only) \??\G: e57471b.exe File opened (read-only) \??\I: e57471b.exe File opened (read-only) \??\N: e57471b.exe File opened (read-only) \??\P: e57471b.exe File opened (read-only) \??\Q: e57471b.exe File opened (read-only) \??\S: e57471b.exe File opened (read-only) \??\E: e5762c1.exe File opened (read-only) \??\G: e5762c1.exe File opened (read-only) \??\H: e57471b.exe File opened (read-only) \??\O: e57471b.exe File opened (read-only) \??\E: e57471b.exe File opened (read-only) \??\J: e57471b.exe File opened (read-only) \??\K: e57471b.exe File opened (read-only) \??\L: e57471b.exe File opened (read-only) \??\M: e57471b.exe File opened (read-only) \??\R: e57471b.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e57471b.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57471b.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57471b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57471b.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57471b.exe -
Drops file in Windows directory 3 IoCs
Processes:
e57471b.exee5762c1.exedescription ioc process File created C:\Windows\e574769 e57471b.exe File opened for modification C:\Windows\SYSTEM.INI e57471b.exe File created C:\Windows\e5797cb e5762c1.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e57471b.exee5762c1.exepid process 4452 e57471b.exe 4452 e57471b.exe 4452 e57471b.exe 4452 e57471b.exe 2732 e5762c1.exe 2732 e5762c1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e57471b.exedescription pid process Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe Token: SeDebugPrivilege 4452 e57471b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee57471b.exee5762c1.exedescription pid process target process PID 632 wrote to memory of 1536 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1536 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1536 632 rundll32.exe rundll32.exe PID 1536 wrote to memory of 4452 1536 rundll32.exe e57471b.exe PID 1536 wrote to memory of 4452 1536 rundll32.exe e57471b.exe PID 1536 wrote to memory of 4452 1536 rundll32.exe e57471b.exe PID 4452 wrote to memory of 780 4452 e57471b.exe fontdrvhost.exe PID 4452 wrote to memory of 788 4452 e57471b.exe fontdrvhost.exe PID 4452 wrote to memory of 340 4452 e57471b.exe dwm.exe PID 4452 wrote to memory of 2836 4452 e57471b.exe sihost.exe PID 4452 wrote to memory of 2880 4452 e57471b.exe svchost.exe PID 4452 wrote to memory of 3020 4452 e57471b.exe taskhostw.exe PID 4452 wrote to memory of 3464 4452 e57471b.exe Explorer.EXE PID 4452 wrote to memory of 3592 4452 e57471b.exe svchost.exe PID 4452 wrote to memory of 3788 4452 e57471b.exe DllHost.exe PID 4452 wrote to memory of 3876 4452 e57471b.exe StartMenuExperienceHost.exe PID 4452 wrote to memory of 3936 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 4016 4452 e57471b.exe SearchApp.exe PID 4452 wrote to memory of 4176 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 4856 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 3684 4452 e57471b.exe TextInputHost.exe PID 4452 wrote to memory of 4648 4452 e57471b.exe backgroundTaskHost.exe PID 4452 wrote to memory of 2500 4452 e57471b.exe backgroundTaskHost.exe PID 4452 wrote to memory of 632 4452 e57471b.exe rundll32.exe PID 4452 wrote to memory of 1536 4452 e57471b.exe rundll32.exe PID 4452 wrote to memory of 1536 4452 e57471b.exe rundll32.exe PID 1536 wrote to memory of 3052 1536 rundll32.exe e574882.exe PID 1536 wrote to memory of 3052 1536 rundll32.exe e574882.exe PID 1536 wrote to memory of 3052 1536 rundll32.exe e574882.exe PID 1536 wrote to memory of 2732 1536 rundll32.exe e5762c1.exe PID 1536 wrote to memory of 2732 1536 rundll32.exe e5762c1.exe PID 1536 wrote to memory of 2732 1536 rundll32.exe e5762c1.exe PID 4452 wrote to memory of 780 4452 e57471b.exe fontdrvhost.exe PID 4452 wrote to memory of 788 4452 e57471b.exe fontdrvhost.exe PID 4452 wrote to memory of 340 4452 e57471b.exe dwm.exe PID 4452 wrote to memory of 2836 4452 e57471b.exe sihost.exe PID 4452 wrote to memory of 2880 4452 e57471b.exe svchost.exe PID 4452 wrote to memory of 3020 4452 e57471b.exe taskhostw.exe PID 4452 wrote to memory of 3464 4452 e57471b.exe Explorer.EXE PID 4452 wrote to memory of 3592 4452 e57471b.exe svchost.exe PID 4452 wrote to memory of 3788 4452 e57471b.exe DllHost.exe PID 4452 wrote to memory of 3876 4452 e57471b.exe StartMenuExperienceHost.exe PID 4452 wrote to memory of 3936 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 4016 4452 e57471b.exe SearchApp.exe PID 4452 wrote to memory of 4176 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 4856 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 3684 4452 e57471b.exe TextInputHost.exe PID 4452 wrote to memory of 4648 4452 e57471b.exe backgroundTaskHost.exe PID 4452 wrote to memory of 3052 4452 e57471b.exe e574882.exe PID 4452 wrote to memory of 3052 4452 e57471b.exe e574882.exe PID 4452 wrote to memory of 1772 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 4960 4452 e57471b.exe RuntimeBroker.exe PID 4452 wrote to memory of 2732 4452 e57471b.exe e5762c1.exe PID 4452 wrote to memory of 2732 4452 e57471b.exe e5762c1.exe PID 2732 wrote to memory of 780 2732 e5762c1.exe fontdrvhost.exe PID 2732 wrote to memory of 788 2732 e5762c1.exe fontdrvhost.exe PID 2732 wrote to memory of 340 2732 e5762c1.exe dwm.exe PID 2732 wrote to memory of 2836 2732 e5762c1.exe sihost.exe PID 2732 wrote to memory of 2880 2732 e5762c1.exe svchost.exe PID 2732 wrote to memory of 3020 2732 e5762c1.exe taskhostw.exe PID 2732 wrote to memory of 3464 2732 e5762c1.exe Explorer.EXE PID 2732 wrote to memory of 3592 2732 e5762c1.exe svchost.exe PID 2732 wrote to memory of 3788 2732 e5762c1.exe DllHost.exe PID 2732 wrote to memory of 3876 2732 e5762c1.exe StartMenuExperienceHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e5762c1.exee57471b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5762c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57471b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19ffaf791aa6e33bac356d6245e7f680_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e57471b.exeC:\Users\Admin\AppData\Local\Temp\e57471b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e574882.exeC:\Users\Admin\AppData\Local\Temp\e574882.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e5762c1.exeC:\Users\Admin\AppData\Local\Temp\e5762c1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e57471b.exeFilesize
97KB
MD50a33845e85940ad475238e35384ae385
SHA16950ffdc59b7cd988a8cf0eaf7c705dbf7daa69f
SHA256dfe5ff1b1e3bb0d351e244808aaae89d3322d00e006070ac71d5bb92efa3152b
SHA512c631c67d6178fc0fbbd29b7a9d6198938574b96528b82fa56fe088763e3bbb253a3e0d1b83847cf40f4cbe40c4ff9d068da4189301975a7600093081614963ce
-
C:\Windows\SYSTEM.INIFilesize
257B
MD50b434251eb11d393a727cb1979e4aaad
SHA1545ddc6861d4868776abb3942d1b7ea74de99bd0
SHA256607f8722f7eb988943a4f147381ff6745aa1ca342b90953554f4c88fbbd7a853
SHA512febb6713bd6613b1603a7f99421e78a13a61cb60ef3ac3a806fa9d10dd363852fd030db989ee7fb4e69287df2a319b2f94d6707725f08ac82657c3449ecf5496
-
memory/1536-21-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/1536-24-0x0000000004280000-0x0000000004282000-memory.dmpFilesize
8KB
-
memory/1536-4-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1536-30-0x0000000004280000-0x0000000004282000-memory.dmpFilesize
8KB
-
memory/1536-20-0x0000000004280000-0x0000000004282000-memory.dmpFilesize
8KB
-
memory/2732-151-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2732-123-0x0000000000B20000-0x0000000001BDA000-memory.dmpFilesize
16.7MB
-
memory/2732-60-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/2732-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2732-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2732-150-0x0000000000B20000-0x0000000001BDA000-memory.dmpFilesize
16.7MB
-
memory/2732-62-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3052-35-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3052-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3052-61-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3052-58-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3052-106-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4452-42-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-65-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-8-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-37-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-36-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-38-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-39-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-40-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-9-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-43-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-23-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/4452-52-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-54-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-55-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-31-0x0000000000630000-0x0000000000632000-memory.dmpFilesize
8KB
-
memory/4452-12-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-29-0x0000000000630000-0x0000000000632000-memory.dmpFilesize
8KB
-
memory/4452-18-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-34-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-19-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-27-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-67-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-70-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-72-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-73-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-74-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-76-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-78-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-80-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-82-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-85-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-102-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4452-91-0x0000000000630000-0x0000000000632000-memory.dmpFilesize
8KB
-
memory/4452-28-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-10-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-11-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-6-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/4452-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB