Analysis
-
max time kernel
148s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 21:25
Static task
static1
Behavioral task
behavioral1
Sample
37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll
-
Size
120KB
-
MD5
37a8422d2b7e1e7709518a1c73c88b40
-
SHA1
883fb36e38caf2f990513300f7177bafc6190f2d
-
SHA256
f00bbb6299643284cdf0d16e9d47dc79e83399d957018aafbd2432004ad8e33c
-
SHA512
4b36ad1c62fa726c4477de606831378ccb6cae9c18dd0b0104c5d8d213a4dc6a316238d01f9cb4f4c46ad8a745fde0fe393f4732080e83b374d02e1ba60de8a2
-
SSDEEP
3072:SJaeXpw8Tgw/K02UA1H+6APMo2lHrPbUU:SJaCp1TNp2lP4MoGLAU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e573c9b.exee576699.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576699.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576699.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576699.exe -
Processes:
e573c9b.exee576699.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576699.exe -
Processes:
e573c9b.exee576699.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576699.exe -
Executes dropped EXE 3 IoCs
Processes:
e573c9b.exee573df3.exee576699.exepid process 1656 e573c9b.exe 3484 e573df3.exe 3616 e576699.exe -
Processes:
resource yara_rule behavioral2/memory/1656-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-21-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-29-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-33-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-34-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-12-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-11-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-39-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-40-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-54-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-55-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-57-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-58-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-59-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-60-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-62-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/1656-70-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3616-88-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3616-90-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3616-101-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3616-94-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3616-141-0x0000000000790000-0x000000000184A000-memory.dmp upx -
Processes:
e573c9b.exee576699.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576699.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576699.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573c9b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576699.exe -
Processes:
e576699.exee573c9b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573c9b.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e573c9b.exee576699.exedescription ioc process File opened (read-only) \??\H: e573c9b.exe File opened (read-only) \??\J: e573c9b.exe File opened (read-only) \??\K: e573c9b.exe File opened (read-only) \??\L: e573c9b.exe File opened (read-only) \??\G: e576699.exe File opened (read-only) \??\E: e573c9b.exe File opened (read-only) \??\G: e573c9b.exe File opened (read-only) \??\I: e573c9b.exe File opened (read-only) \??\E: e576699.exe File opened (read-only) \??\H: e576699.exe File opened (read-only) \??\I: e576699.exe -
Drops file in Windows directory 3 IoCs
Processes:
e573c9b.exee576699.exedescription ioc process File created C:\Windows\e573d28 e573c9b.exe File opened for modification C:\Windows\SYSTEM.INI e573c9b.exe File created C:\Windows\e578e55 e576699.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e573c9b.exee576699.exepid process 1656 e573c9b.exe 1656 e573c9b.exe 1656 e573c9b.exe 1656 e573c9b.exe 3616 e576699.exe 3616 e576699.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e573c9b.exedescription pid process Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe Token: SeDebugPrivilege 1656 e573c9b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee573c9b.exee576699.exedescription pid process target process PID 5000 wrote to memory of 1996 5000 rundll32.exe rundll32.exe PID 5000 wrote to memory of 1996 5000 rundll32.exe rundll32.exe PID 5000 wrote to memory of 1996 5000 rundll32.exe rundll32.exe PID 1996 wrote to memory of 1656 1996 rundll32.exe e573c9b.exe PID 1996 wrote to memory of 1656 1996 rundll32.exe e573c9b.exe PID 1996 wrote to memory of 1656 1996 rundll32.exe e573c9b.exe PID 1656 wrote to memory of 776 1656 e573c9b.exe fontdrvhost.exe PID 1656 wrote to memory of 780 1656 e573c9b.exe fontdrvhost.exe PID 1656 wrote to memory of 316 1656 e573c9b.exe dwm.exe PID 1656 wrote to memory of 2696 1656 e573c9b.exe sihost.exe PID 1656 wrote to memory of 2716 1656 e573c9b.exe svchost.exe PID 1656 wrote to memory of 3028 1656 e573c9b.exe taskhostw.exe PID 1656 wrote to memory of 3508 1656 e573c9b.exe Explorer.EXE PID 1656 wrote to memory of 3668 1656 e573c9b.exe svchost.exe PID 1656 wrote to memory of 3864 1656 e573c9b.exe DllHost.exe PID 1656 wrote to memory of 3956 1656 e573c9b.exe StartMenuExperienceHost.exe PID 1656 wrote to memory of 4020 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 732 1656 e573c9b.exe SearchApp.exe PID 1656 wrote to memory of 3920 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 4728 1656 e573c9b.exe TextInputHost.exe PID 1656 wrote to memory of 4836 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 4496 1656 e573c9b.exe backgroundTaskHost.exe PID 1656 wrote to memory of 392 1656 e573c9b.exe backgroundTaskHost.exe PID 1656 wrote to memory of 5000 1656 e573c9b.exe rundll32.exe PID 1656 wrote to memory of 1996 1656 e573c9b.exe rundll32.exe PID 1656 wrote to memory of 1996 1656 e573c9b.exe rundll32.exe PID 1996 wrote to memory of 3484 1996 rundll32.exe e573df3.exe PID 1996 wrote to memory of 3484 1996 rundll32.exe e573df3.exe PID 1996 wrote to memory of 3484 1996 rundll32.exe e573df3.exe PID 1996 wrote to memory of 3616 1996 rundll32.exe e576699.exe PID 1996 wrote to memory of 3616 1996 rundll32.exe e576699.exe PID 1996 wrote to memory of 3616 1996 rundll32.exe e576699.exe PID 1656 wrote to memory of 776 1656 e573c9b.exe fontdrvhost.exe PID 1656 wrote to memory of 780 1656 e573c9b.exe fontdrvhost.exe PID 1656 wrote to memory of 316 1656 e573c9b.exe dwm.exe PID 1656 wrote to memory of 2696 1656 e573c9b.exe sihost.exe PID 1656 wrote to memory of 2716 1656 e573c9b.exe svchost.exe PID 1656 wrote to memory of 3028 1656 e573c9b.exe taskhostw.exe PID 1656 wrote to memory of 3508 1656 e573c9b.exe Explorer.EXE PID 1656 wrote to memory of 3668 1656 e573c9b.exe svchost.exe PID 1656 wrote to memory of 3864 1656 e573c9b.exe DllHost.exe PID 1656 wrote to memory of 3956 1656 e573c9b.exe StartMenuExperienceHost.exe PID 1656 wrote to memory of 4020 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 732 1656 e573c9b.exe SearchApp.exe PID 1656 wrote to memory of 3920 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 4728 1656 e573c9b.exe TextInputHost.exe PID 1656 wrote to memory of 4836 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 4496 1656 e573c9b.exe backgroundTaskHost.exe PID 1656 wrote to memory of 392 1656 e573c9b.exe backgroundTaskHost.exe PID 1656 wrote to memory of 5000 1656 e573c9b.exe rundll32.exe PID 1656 wrote to memory of 3484 1656 e573c9b.exe e573df3.exe PID 1656 wrote to memory of 3484 1656 e573c9b.exe e573df3.exe PID 1656 wrote to memory of 3176 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 4224 1656 e573c9b.exe RuntimeBroker.exe PID 1656 wrote to memory of 4524 1656 e573c9b.exe BackgroundTransferHost.exe PID 3616 wrote to memory of 776 3616 e576699.exe fontdrvhost.exe PID 3616 wrote to memory of 780 3616 e576699.exe fontdrvhost.exe PID 3616 wrote to memory of 316 3616 e576699.exe dwm.exe PID 3616 wrote to memory of 2696 3616 e576699.exe sihost.exe PID 3616 wrote to memory of 2716 3616 e576699.exe svchost.exe PID 3616 wrote to memory of 3028 3616 e576699.exe taskhostw.exe PID 3616 wrote to memory of 3508 3616 e576699.exe Explorer.EXE PID 3616 wrote to memory of 3668 3616 e576699.exe svchost.exe PID 3616 wrote to memory of 3864 3616 e576699.exe DllHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e576699.exee573c9b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576699.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573c9b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37a8422d2b7e1e7709518a1c73c88b40_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e573c9b.exeC:\Users\Admin\AppData\Local\Temp\e573c9b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e573df3.exeC:\Users\Admin\AppData\Local\Temp\e573df3.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e576699.exeC:\Users\Admin\AppData\Local\Temp\e576699.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e573c9b.exeFilesize
97KB
MD5d4c4f8a8f32907e9328f6ca813a3b3ce
SHA11bf0d56475d8d32a96357edb174b5bec97340ee9
SHA2566a25c1983f441074afc73199242e115c4bb753cde6913098ad8dd0cd1130888d
SHA51207b175de563f672ad8026b965283a0b9ddf357170524b3e330667a4b1bf7ae405bbdb8dad36d0d3bdfba62391b641a194838298b4dffe9f872b2f6972c22159b
-
C:\Windows\SYSTEM.INIFilesize
257B
MD530b946017548221cdeca55174b48a0a2
SHA1ba504d0da959fddafad32bd0caa81aabc5f256c0
SHA2565963f32feb355ef03720969df9b8fc016db9be12f73a7b81102d3788a5e84378
SHA512f17e27b84cb163d6d6ddf315ae0b530001ee6a94bd4690f5412ae405b87174925d7b1da7b154d13f63e10e1e21bd0fbbfef503a9bf43f0b1b0adb38615dd016b
-
memory/1656-39-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-62-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-8-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-40-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-70-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-31-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1656-21-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-29-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-24-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1656-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1656-33-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-35-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-34-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-12-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1656-16-0x0000000003D30000-0x0000000003D31000-memory.dmpFilesize
4KB
-
memory/1656-75-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1656-11-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-10-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-36-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-37-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-38-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-9-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-6-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-59-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-60-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-58-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-57-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-54-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1656-55-0x0000000000760000-0x000000000181A000-memory.dmpFilesize
16.7MB
-
memory/1996-3-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1996-23-0x0000000003500000-0x0000000003501000-memory.dmpFilesize
4KB
-
memory/1996-13-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/1996-22-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/1996-17-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/3484-51-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3484-52-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3484-53-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3484-87-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3616-101-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3616-88-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3616-90-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3616-141-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3616-109-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/3616-108-0x0000000000590000-0x0000000000592000-memory.dmpFilesize
8KB
-
memory/3616-94-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3616-140-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3616-49-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB