8f96e7c46536ed8940c7950aa8525fcd57f40d118a2c417bbae4682a0bebc14b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe
Size

64KB
MD5

2be9233367cf3a95c63505a0a5132080
SHA1

b9211a5d347fe4719ed90c2291e184bc19156bd2
SHA256

8f96e7c46536ed8940c7950aa8525fcd57f40d118a2c417bbae4682a0bebc14b
SHA512

c145ddd1ffacfa29be69537659a506ab6971f76121125f5f4c5ec69ff812ae0f6b996110a576ecebe00bb9909520d1b598485dbb48a00834f7fde349ebd7b46a
SSDEEP

384:ObIwOs8AHsc4sMDwhKQLro64/CFsrdHWMZp:OEw9816vhKQLro64/wQpWMZp

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8C35520-FB1C-49ad-99F0-D95DE817462D}\stubpath = "C:\\Windows\\{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe"	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE90915-417E-4aba-B57D-0203E8C619DC}	{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}\stubpath = "C:\\Windows\\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe"	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20E83C20-9485-4e57-9547-B8A623E96C4D}	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29CAFED0-A94B-4796-A70F-11C0647417BD}\stubpath = "C:\\Windows\\{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe"	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{894DF83B-1388-4178-889F-35FC92B8DAAF}	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}\stubpath = "C:\\Windows\\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe"	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}\stubpath = "C:\\Windows\\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe"	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED40F526-F6A3-472d-B672-D07C525D874D}	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED40F526-F6A3-472d-B672-D07C525D874D}\stubpath = "C:\\Windows\\{ED40F526-F6A3-472d-B672-D07C525D874D}.exe"	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}\stubpath = "C:\\Windows\\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe"	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}\stubpath = "C:\\Windows\\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe"	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EE90915-417E-4aba-B57D-0203E8C619DC}\stubpath = "C:\\Windows\\{1EE90915-417E-4aba-B57D-0203E8C619DC}.exe"	{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20E83C20-9485-4e57-9547-B8A623E96C4D}\stubpath = "C:\\Windows\\{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe"	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8C35520-FB1C-49ad-99F0-D95DE817462D}	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}\stubpath = "C:\\Windows\\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe"	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29CAFED0-A94B-4796-A70F-11C0647417BD}	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{894DF83B-1388-4178-889F-35FC92B8DAAF}\stubpath = "C:\\Windows\\{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe"	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe

Executes dropped EXE 12 IoCs

pid	Process
1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe
4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe
396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
3252	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
1404	{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe
4764	{1EE90915-417E-4aba-B57D-0203E8C619DC}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
File created	C:\Windows\{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
File created	C:\Windows\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
File created	C:\Windows\{1EE90915-417E-4aba-B57D-0203E8C619DC}.exe	{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe
File created	C:\Windows\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
File created	C:\Windows\{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
File created	C:\Windows\{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
File created	C:\Windows\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
File created	C:\Windows\{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe
File created	C:\Windows\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
File created	C:\Windows\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe
File created	C:\Windows\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
Token: SeIncBasePriorityPrivilege	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
Token: SeIncBasePriorityPrivilege	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
Token: SeIncBasePriorityPrivilege	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
Token: SeIncBasePriorityPrivilege	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe
Token: SeIncBasePriorityPrivilege	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
Token: SeIncBasePriorityPrivilege	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
Token: SeIncBasePriorityPrivilege	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe
Token: SeIncBasePriorityPrivilege	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
Token: SeIncBasePriorityPrivilege	3252	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
Token: SeIncBasePriorityPrivilege	1404	{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1252	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe	96
PID 1724 wrote to memory of 1252	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe	96
PID 1724 wrote to memory of 1252	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe	96
PID 1724 wrote to memory of 3028	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe	97
PID 1724 wrote to memory of 3028	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe	97
PID 1724 wrote to memory of 3028	1724	2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe	97
PID 1252 wrote to memory of 3528	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	98
PID 1252 wrote to memory of 3528	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	98
PID 1252 wrote to memory of 3528	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	98
PID 1252 wrote to memory of 5008	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	99
PID 1252 wrote to memory of 5008	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	99
PID 1252 wrote to memory of 5008	1252	{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe	99
PID 3528 wrote to memory of 2016	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	102
PID 3528 wrote to memory of 2016	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	102
PID 3528 wrote to memory of 2016	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	102
PID 3528 wrote to memory of 3404	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	103
PID 3528 wrote to memory of 3404	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	103
PID 3528 wrote to memory of 3404	3528	{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe	103
PID 2016 wrote to memory of 1088	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	104
PID 2016 wrote to memory of 1088	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	104
PID 2016 wrote to memory of 1088	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	104
PID 2016 wrote to memory of 3440	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	105
PID 2016 wrote to memory of 3440	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	105
PID 2016 wrote to memory of 3440	2016	{ED40F526-F6A3-472d-B672-D07C525D874D}.exe	105
PID 1088 wrote to memory of 1996	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	106
PID 1088 wrote to memory of 1996	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	106
PID 1088 wrote to memory of 1996	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	106
PID 1088 wrote to memory of 3876	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	107
PID 1088 wrote to memory of 3876	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	107
PID 1088 wrote to memory of 3876	1088	{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe	107
PID 1996 wrote to memory of 4776	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	109
PID 1996 wrote to memory of 4776	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	109
PID 1996 wrote to memory of 4776	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	109
PID 1996 wrote to memory of 1612	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	110
PID 1996 wrote to memory of 1612	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	110
PID 1996 wrote to memory of 1612	1996	{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe	110
PID 4776 wrote to memory of 4076	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	111
PID 4776 wrote to memory of 4076	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	111
PID 4776 wrote to memory of 4076	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	111
PID 4776 wrote to memory of 3860	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	112
PID 4776 wrote to memory of 3860	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	112
PID 4776 wrote to memory of 3860	4776	{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe	112
PID 4076 wrote to memory of 3556	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	119
PID 4076 wrote to memory of 3556	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	119
PID 4076 wrote to memory of 3556	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	119
PID 4076 wrote to memory of 3284	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	120
PID 4076 wrote to memory of 3284	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	120
PID 4076 wrote to memory of 3284	4076	{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe	120
PID 3556 wrote to memory of 396	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	121
PID 3556 wrote to memory of 396	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	121
PID 3556 wrote to memory of 396	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	121
PID 3556 wrote to memory of 624	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	122
PID 3556 wrote to memory of 624	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	122
PID 3556 wrote to memory of 624	3556	{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe	122
PID 396 wrote to memory of 3252	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	123
PID 396 wrote to memory of 3252	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	123
PID 396 wrote to memory of 3252	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	123
PID 396 wrote to memory of 5072	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	124
PID 396 wrote to memory of 5072	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	124
PID 396 wrote to memory of 5072	396	{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe	124
PID 3252 wrote to memory of 1404	3252	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe	125
PID 3252 wrote to memory of 1404	3252	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe	125
PID 3252 wrote to memory of 1404	3252	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe	125
PID 3252 wrote to memory of 4992	3252	{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe	126

C:\Users\Admin\AppData\Local\Temp\2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2be9233367cf3a95c63505a0a5132080_NeikiAnalytics.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
  C:\Windows\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
    C:\Windows\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
      C:\Windows\{ED40F526-F6A3-472d-B672-D07C525D874D}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
        
        C:\Windows\{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Windows\{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe
        
        C:\Windows\{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
        
        C:\Windows\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
        
        C:\Windows\{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe
        
        C:\Windows\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
        
        C:\Windows\{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
        
        C:\Windows\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe
        
        C:\Windows\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
        
        C:\Windows\{1EE90915-417E-4aba-B57D-0203E8C619DC}.exe
        
        C:\Windows\{1EE90915-417E-4aba-B57D-0203E8C619DC}.exe
        13⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{900DF~1.EXE > nul
        13⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B9CD2~1.EXE > nul
        12⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{894DF~1.EXE > nul
        11⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E1A5~1.EXE > nul
        10⤵
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{29CAF~1.EXE > nul
        9⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A75F~1.EXE > nul
        8⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F8C35~1.EXE > nul
        7⤵
        
        PID:1612
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{20E83~1.EXE > nul
        6⤵
        
        PID:3876
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ED40F~1.EXE > nul
        5⤵
        
        PID:3440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{3AF59~1.EXE > nul
      4⤵
      PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{64C6B~1.EXE > nul
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2BE923~1.EXE > nul
  2⤵
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{1EE90915-417E-4aba-B57D-0203E8C619DC}.exe

Filesize
64KB

MD5
62c8aa5424a1e661bab0a5456a9758e3

SHA1
4b43d4f66d4d4cd452fd2ffaea6baf6d1d627130

SHA256
e88caecc7042ba2e9d4d96654ac667b09d36dba9696c1102f6308a7b641ce080

SHA512
0633ab332d8743ae5b16a4cc81b2a7c559ca26bd7f7b95a81829016bdff683c9ddc09fbb189186fc9c99dc5bf04b7523577484a301dda9f40485b570cba060c4

Download Submit
C:\Windows\{20E83C20-9485-4e57-9547-B8A623E96C4D}.exe

Filesize
64KB

MD5
79e6d760a7f196e36770571a8f1a1cb5

SHA1
56753fbf44474c960f7b75259d4105c981008c04

SHA256
9e9918bed1aa4d66d8584d4134ae070ed250ea24b6840465c724cd1f7e0fbb1b

SHA512
b9d3d85e3a205447ad15291701410ea2d56886b33e10275c050d7c626aedfab756f0c9f5f120fc82e9f518cce924f6177da0f3ba64d9b10ecfc25652d9a74378

Download Submit
C:\Windows\{29CAFED0-A94B-4796-A70F-11C0647417BD}.exe

Filesize
64KB

MD5
cd1e9af7a72501e85b9647b76577ddce

SHA1
9fe53a0cbfb1d10df10f8fae66f82f37d29d91f7

SHA256
fe9f2ee8e3e688e0702246e235c8127eb5830d74f3a93997af4504a89b479959

SHA512
7df094ebf305aa7a553d00c731c4847f2c11bbdc696d1cffddcf51b0c0969a9db7386c60a7f8694404ccb7f3f3855b56658693555ce07ec0ab1aa070aa4acbe4

Download Submit
C:\Windows\{3AF59DC5-BB63-4e0f-B514-AB199DD2D8AB}.exe

Filesize
64KB

MD5
cd61fd7c97ec850a3f1ffc28e93a9226

SHA1
32ea74822f1d7c21e6a017326b4f6b51c28857a4

SHA256
c76aaf415b2502dd2bdd93d3df2512705188761a778a9b4437d7193ced041b1c

SHA512
4f3aea181c13f5f9151f2dac99624503865efb5b2c266c5e52fa978db6f5b69781e095302fedf69769edb64eb2cb537f42763652e60888efb316bb8b8637b2e0

Download Submit
C:\Windows\{4E1A5BF0-F9F8-461b-958B-303013E7F8D1}.exe

Filesize
64KB

MD5
e67b8c89e5b20e510d2755067008460e

SHA1
fa128a8a4988baeecc323d7264c8b4963dbf42b3

SHA256
bd382211b00e0a382d747dccf41d5367406549258c8c532df7c1e3d43ab448ba

SHA512
05e9bd62680ade0dfb61fcd79e4fe7d86b06291d143248f8d1c6ad706c1574a1dab1f737fd6045d7409c598b4c35e5aa9d0a7bbf00acca95138b9b17a65d2dd1

Download Submit
C:\Windows\{64C6B4FC-17EB-4e2d-B3AE-DF5F0626B704}.exe

Filesize
64KB

MD5
205e79a40cb188561b0e3d253eb6079a

SHA1
2882b1cae9da740390d0c79bf6666809f3740fbb

SHA256
10064f0bc84e2c87c672ef1b32b6677e7d1c565efc1eb0942f96b1a31db85c18

SHA512
8553f2e021349d4b12aa0da057092856a9a5fa14a08592b3de6a0e884dc68748d1aa51583e0c3bddd258ee46be84504099817086a6f5068566cd99ba805cd8e3

Download Submit
C:\Windows\{894DF83B-1388-4178-889F-35FC92B8DAAF}.exe

Filesize
64KB

MD5
6fd6bcd855311decefef493447dd476a

SHA1
538157302abf2dc623db98181f3bb1ec9c608d43

SHA256
f790a51b76344dabebc3b1bc7f4c12d117a100458ad82bf1799264a46d157326

SHA512
41fdfb843446a38fb441ae742039478278d2364e11a0c7a83689262690050afb5d857d38cb5cf064d462b766a6c49f69a1b4c44dbb248d28766252acbe1c2bd9

Download Submit
C:\Windows\{900DF0F4-65EB-4100-BC2B-FCFB383DA488}.exe

Filesize
64KB

MD5
e47f398bb80be07e07966bc17d3b1f72

SHA1
85ad531c9d6042b93349eeef909ea1e9b9950f3d

SHA256
794f298b2965e797e9ffaa71a60b862dfd22227b6df1aa9d578f5d7b55ca2580

SHA512
e37c38b256ccf6e4ff7fe87195104c4bc6c4c1d5e79a41f15b589b75577e866d3b389093e32aadd558f4fb2ee927d765237dc7b3a8681f1ea3fc2a152f3547c8

Download Submit
C:\Windows\{9A75F5F8-ECC5-4b5f-BBFB-D3B1B5F5EE75}.exe

Filesize
64KB

MD5
5fda1b7c301bfc729d3e18444b15bb77

SHA1
ef0100d8e21dae304153d3af4a85292df6f42fc7

SHA256
fb8ea5cd76fa6ab04515aea2f1721c72cf5ca53de6620b156a71a6bd1307f276

SHA512
9be883c99e957ce43c788b8a47daacc9c202243aef2473111bc59991b9868807bedd262d32d67cb449bb575cc92d48e570bb9c811f4bfe256713fc3507a94865

Download Submit
C:\Windows\{B9CD28EC-6CD4-4c0d-A3DC-23B033FD2136}.exe

Filesize
64KB

MD5
67f2ede70fa31afa19cf3403e9bdbe3e

SHA1
c4fee912044f0e4cd21140851420b1cae631cb96

SHA256
c652237aaf63354ef60be4f373f7e320f2982567308a2237647aba4013076d0f

SHA512
fb7516609e72f6f77f7111492babab40644c995d7a3b3518e3bd3bd77d0da7a32fc33a6be285125e1c483af13a3ca33d0eaa2dfdc7d1b9b5852ff2e201b1b76f

Download Submit
C:\Windows\{ED40F526-F6A3-472d-B672-D07C525D874D}.exe

Filesize
64KB

MD5
4c6841c4e962f6b4855f0e9a9ede8430

SHA1
9036893e336c24d3847b81ed46a64e1edc8492fe

SHA256
9d891d44b9fad7a215e6f4a00add28a34d590ecd25c612a24ce6a2db8aa3ead7

SHA512
ec1ad49210b9f40c784488fbed946d6dfebea9765a13f359f3819683cbba654bdc48837334370a32c491d498fadca7440f5d9b7b5a23c131c0051cab0f83c279

Download Submit
C:\Windows\{F8C35520-FB1C-49ad-99F0-D95DE817462D}.exe

Filesize
64KB

MD5
5678b4ce33566a6a8309c0b43925d198

SHA1
17c2b4ae3c27a2d885d6104390bde257d2165c36

SHA256
07d41f959b04aa24d3fc05428dd8226446c05d3d034d65c8c71d645499877498

SHA512
1574b202636f559fc9a7a29546f881bf8403f2afe9e09024440ce5b583b91fd723d38bb0120dd73cae211a07326fddf42ed8d6c142aa66e5ede7cdec41d9be30

Download Submit
memory/396-53-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/396-56-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1088-23-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1088-28-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1252-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1252-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1404-64-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1404-69-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1724-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1724-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1996-30-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1996-35-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2016-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2016-22-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3252-63-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3252-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3528-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3528-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3556-51-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3556-46-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4076-45-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4764-71-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4776-41-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4776-36-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads