Analysis
- max time kernel
131s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll
Resource
win7-20240508-en
windows7-x64
15 signatures
150 seconds
General
- Target 71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll
- Size 120KB
- Sample240518-cexx9afa76
- SHA256 4f1685e794740ffdc9f745bceb81a7a81452714a8aa50b9a0a9afcb6215069cc
- MD5 71bf557af059e84b2393502a23035b10
- SHA1 9e8d9fb88c6f4231df799e2ee344e47558dcd4e8
- SHA512 950f4b66d8cd2f653b07f6ae4f0693b0426f4fa5ee7b4d1f8f167c7e24774933873cf7f2c10a985f8e0525d825fa44c11175e2a8bc21ba483f9e40b705068687
- SSDEEP 3072:eHrfBgynLi9sDfiJdQRCPh1zIRONHJ9FEupeVj42onm:ErfCyLCwfudGCPh1URObEh42onm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57598a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57598a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57598a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57598a.exe - Executes dropped EXE 3 IoCs
pid Process 2352 e573df3.exe 2080 e574045.exe 4860 e57598a.exe -
resource yara_rule behavioral2/memory/2352-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-28-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-31-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-20-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-18-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-19-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-38-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-40-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-41-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-43-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-44-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-53-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-55-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-56-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-66-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-68-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-71-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-73-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-75-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-77-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-78-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-80-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-81-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-82-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-84-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-101-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4860-129-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4860-154-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573df3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573df3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57598a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57598a.exe - Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e573df3.exe File opened (read-only) \??\S: e573df3.exe File opened (read-only) \??\E: e573df3.exe File opened (read-only) \??\L: e573df3.exe File opened (read-only) \??\M: e573df3.exe File opened (read-only) \??\N: e573df3.exe File opened (read-only) \??\P: e573df3.exe File opened (read-only) \??\K: e573df3.exe File opened (read-only) \??\O: e573df3.exe File opened (read-only) \??\R: e573df3.exe File opened (read-only) \??\G: e573df3.exe File opened (read-only) \??\H: e573df3.exe File opened (read-only) \??\J: e573df3.exe File opened (read-only) \??\Q: e573df3.exe File opened (read-only) \??\E: e57598a.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e573df3.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573df3.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573df3.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e573df3.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e573e70 e573df3.exe File opened for modification C:\Windows\SYSTEM.INI e573df3.exe File created C:\Windows\e579078 e57598a.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2352 e573df3.exe 2352 e573df3.exe 2352 e573df3.exe 2352 e573df3.exe 4860 e57598a.exe 4860 e57598a.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1468 wrote to memory of 3592 1468 rundll32.exe 83 PID 1468 wrote to memory of 3592 1468 rundll32.exe 83 PID 1468 wrote to memory of 3592 1468 rundll32.exe 83 PID 3592 wrote to memory of 2352 3592 rundll32.exe 84 PID 3592 wrote to memory of 2352 3592 rundll32.exe 84 PID 3592 wrote to memory of 2352 3592 rundll32.exe 84 PID 2352 wrote to memory of 776 2352 e573df3.exe 8 PID 2352 wrote to memory of 784 2352 e573df3.exe 9 PID 2352 wrote to memory of 332 2352 e573df3.exe 13 PID 2352 wrote to memory of 2888 2352 e573df3.exe 49 PID 2352 wrote to memory of 2900 2352 e573df3.exe 50 PID 2352 wrote to memory of 3016 2352 e573df3.exe 51 PID 2352 wrote to memory of 3436 2352 e573df3.exe 56 PID 2352 wrote to memory of 3580 2352 e573df3.exe 57 PID 2352 wrote to memory of 3760 2352 e573df3.exe 58 PID 2352 wrote to memory of 3852 2352 e573df3.exe 59 PID 2352 wrote to memory of 3912 2352 e573df3.exe 60 PID 2352 wrote to memory of 4000 2352 e573df3.exe 61 PID 2352 wrote to memory of 696 2352 e573df3.exe 62 PID 2352 wrote to memory of 3820 2352 e573df3.exe 74 PID 2352 wrote to memory of 1952 2352 e573df3.exe 75 PID 2352 wrote to memory of 3428 2352 e573df3.exe 80 PID 2352 wrote to memory of 1204 2352 e573df3.exe 81 PID 2352 wrote to memory of 1468 2352 e573df3.exe 82 PID 2352 wrote to memory of 3592 2352 e573df3.exe 83 PID 2352 wrote to memory of 3592 2352 e573df3.exe 83 PID 3592 wrote to memory of 2080 3592 rundll32.exe 85 PID 3592 wrote to memory of 2080 3592 rundll32.exe 85 PID 3592 wrote to memory of 2080 3592 rundll32.exe 85 PID 3592 wrote to memory of 4860 3592 rundll32.exe 90 PID 3592 wrote to memory of 4860 3592 rundll32.exe 90 PID 3592 wrote to memory of 4860 3592 rundll32.exe 90 PID 2352 wrote to memory of 776 2352 e573df3.exe 8 PID 2352 wrote to memory of 784 2352 e573df3.exe 9 PID 2352 wrote to memory of 332 2352 e573df3.exe 13 PID 2352 wrote to memory of 2888 2352 e573df3.exe 49 PID 2352 wrote to memory of 2900 2352 e573df3.exe 50 PID 2352 wrote to memory of 3016 2352 e573df3.exe 51 PID 2352 wrote to memory of 3436 2352 e573df3.exe 56 PID 2352 wrote to memory of 3580 2352 e573df3.exe 57 PID 2352 wrote to memory of 3760 2352 e573df3.exe 58 PID 2352 wrote to memory of 3852 2352 e573df3.exe 59 PID 2352 wrote to memory of 3912 2352 e573df3.exe 60 PID 2352 wrote to memory of 4000 2352 e573df3.exe 61 PID 2352 wrote to memory of 696 2352 e573df3.exe 62 PID 2352 wrote to memory of 3820 2352 e573df3.exe 74 PID 2352 wrote to memory of 1952 2352 e573df3.exe 75 PID 2352 wrote to memory of 3428 2352 e573df3.exe 80 PID 2352 wrote to memory of 2080 2352 e573df3.exe 85 PID 2352 wrote to memory of 2080 2352 e573df3.exe 85 PID 2352 wrote to memory of 2764 2352 e573df3.exe 87 PID 2352 wrote to memory of 2092 2352 e573df3.exe 88 PID 2352 wrote to memory of 4860 2352 e573df3.exe 90 PID 2352 wrote to memory of 4860 2352 e573df3.exe 90 PID 4860 wrote to memory of 776 4860 e57598a.exe 8 PID 4860 wrote to memory of 784 4860 e57598a.exe 9 PID 4860 wrote to memory of 332 4860 e57598a.exe 13 PID 4860 wrote to memory of 2888 4860 e57598a.exe 49 PID 4860 wrote to memory of 2900 4860 e57598a.exe 50 PID 4860 wrote to memory of 3016 4860 e57598a.exe 51 PID 4860 wrote to memory of 3436 4860 e57598a.exe 56 PID 4860 wrote to memory of 3580 4860 e57598a.exe 57 PID 4860 wrote to memory of 3760 4860 e57598a.exe 58 PID 4860 wrote to memory of 3852 4860 e57598a.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57598a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2900
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3016
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\e573df3.exeC:\Users\Admin\AppData\Local\Temp\e573df3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\e574045.exeC:\Users\Admin\AppData\Local\Temp\e574045.exe4⤵
- Executes dropped EXE
PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\e57598a.exeC:\Users\Admin\AppData\Local\Temp\e57598a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4860
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:696
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1952
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3428
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1204
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2092
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e573df3.exe
- Size 97KB
- SHA256 6d24e447bbd40cdb4753cab916400bba25dc7a3257fb11f420cd238f7b1b546a
- MD5 fae4bfd1175d7bed1e02a018c07537b0
- SHA1 f67698366b29359c2d442e05aa36a98b30f17a6b
- SHA512 47665606f48be8d8e745f3efe6f814b3a916ae81dc81853968045061cee919234389b258f9b53cd924a93d981c1553f8b765c3e051a9941f4ecd189556e6274d
- SSDEEP 1536:BzNT8Y1BAcEeoykjRmSLVDZBMo7B/MIBMqKNzsUZZlRqP:MOkJLVNBMopMiMr/CP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 2524f6749654f4329f1440ee21010336a139e5f39949ddd235bcf490218a4d9f
- MD5 4d1bdbb9b4f086de64d7e4cd9368829c
- SHA1 b795ca541c95018835772b54abda7d2d5dd5a8b8
- SHA512 ce906f0602811607d6450bee2970d77d1e8ad018cf36e72d9dc5e740980ff8a3c445325b369ec08e84f3d4d8624fa0a37cd1491d8b33ceb80862c79dc1d00381
- MD5 SHA1 SHA512