Analysis
-
max time kernel
131s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 01:59
Static task
static1
Behavioral task
behavioral1
Sample
71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll
-
Size
120KB
-
MD5
71bf557af059e84b2393502a23035b10
-
SHA1
9e8d9fb88c6f4231df799e2ee344e47558dcd4e8
-
SHA256
4f1685e794740ffdc9f745bceb81a7a81452714a8aa50b9a0a9afcb6215069cc
-
SHA512
950f4b66d8cd2f653b07f6ae4f0693b0426f4fa5ee7b4d1f8f167c7e24774933873cf7f2c10a985f8e0525d825fa44c11175e2a8bc21ba483f9e40b705068687
-
SSDEEP
3072:eHrfBgynLi9sDfiJdQRCPh1zIRONHJ9FEupeVj42onm:ErfCyLCwfudGCPh1URObEh42onm
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e57598a.exee573df3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57598a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57598a.exe -
Processes:
e573df3.exee57598a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57598a.exe -
Processes:
e573df3.exee57598a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57598a.exe -
Executes dropped EXE 3 IoCs
Processes:
e573df3.exee574045.exee57598a.exepid process 2352 e573df3.exe 2080 e574045.exe 4860 e57598a.exe -
Processes:
resource yara_rule behavioral2/memory/2352-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-28-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-31-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-20-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-18-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-19-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-38-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-40-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-41-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-43-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-44-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-53-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-55-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-56-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-66-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-68-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-71-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-73-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-75-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-77-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-78-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-80-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-81-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-82-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-84-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/2352-101-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4860-129-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4860-154-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e573df3.exee57598a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573df3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573df3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57598a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57598a.exe -
Processes:
e573df3.exee57598a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57598a.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e573df3.exee57598a.exedescription ioc process File opened (read-only) \??\I: e573df3.exe File opened (read-only) \??\S: e573df3.exe File opened (read-only) \??\E: e573df3.exe File opened (read-only) \??\L: e573df3.exe File opened (read-only) \??\M: e573df3.exe File opened (read-only) \??\N: e573df3.exe File opened (read-only) \??\P: e573df3.exe File opened (read-only) \??\K: e573df3.exe File opened (read-only) \??\O: e573df3.exe File opened (read-only) \??\R: e573df3.exe File opened (read-only) \??\G: e573df3.exe File opened (read-only) \??\H: e573df3.exe File opened (read-only) \??\J: e573df3.exe File opened (read-only) \??\Q: e573df3.exe File opened (read-only) \??\E: e57598a.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e573df3.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e573df3.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573df3.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573df3.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e573df3.exe -
Drops file in Windows directory 3 IoCs
Processes:
e573df3.exee57598a.exedescription ioc process File created C:\Windows\e573e70 e573df3.exe File opened for modification C:\Windows\SYSTEM.INI e573df3.exe File created C:\Windows\e579078 e57598a.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e573df3.exee57598a.exepid process 2352 e573df3.exe 2352 e573df3.exe 2352 e573df3.exe 2352 e573df3.exe 4860 e57598a.exe 4860 e57598a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e573df3.exedescription pid process Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe Token: SeDebugPrivilege 2352 e573df3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee573df3.exee57598a.exedescription pid process target process PID 1468 wrote to memory of 3592 1468 rundll32.exe rundll32.exe PID 1468 wrote to memory of 3592 1468 rundll32.exe rundll32.exe PID 1468 wrote to memory of 3592 1468 rundll32.exe rundll32.exe PID 3592 wrote to memory of 2352 3592 rundll32.exe e573df3.exe PID 3592 wrote to memory of 2352 3592 rundll32.exe e573df3.exe PID 3592 wrote to memory of 2352 3592 rundll32.exe e573df3.exe PID 2352 wrote to memory of 776 2352 e573df3.exe fontdrvhost.exe PID 2352 wrote to memory of 784 2352 e573df3.exe fontdrvhost.exe PID 2352 wrote to memory of 332 2352 e573df3.exe dwm.exe PID 2352 wrote to memory of 2888 2352 e573df3.exe sihost.exe PID 2352 wrote to memory of 2900 2352 e573df3.exe svchost.exe PID 2352 wrote to memory of 3016 2352 e573df3.exe taskhostw.exe PID 2352 wrote to memory of 3436 2352 e573df3.exe Explorer.EXE PID 2352 wrote to memory of 3580 2352 e573df3.exe svchost.exe PID 2352 wrote to memory of 3760 2352 e573df3.exe DllHost.exe PID 2352 wrote to memory of 3852 2352 e573df3.exe StartMenuExperienceHost.exe PID 2352 wrote to memory of 3912 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 4000 2352 e573df3.exe SearchApp.exe PID 2352 wrote to memory of 696 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 3820 2352 e573df3.exe TextInputHost.exe PID 2352 wrote to memory of 1952 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 3428 2352 e573df3.exe backgroundTaskHost.exe PID 2352 wrote to memory of 1204 2352 e573df3.exe backgroundTaskHost.exe PID 2352 wrote to memory of 1468 2352 e573df3.exe rundll32.exe PID 2352 wrote to memory of 3592 2352 e573df3.exe rundll32.exe PID 2352 wrote to memory of 3592 2352 e573df3.exe rundll32.exe PID 3592 wrote to memory of 2080 3592 rundll32.exe e574045.exe PID 3592 wrote to memory of 2080 3592 rundll32.exe e574045.exe PID 3592 wrote to memory of 2080 3592 rundll32.exe e574045.exe PID 3592 wrote to memory of 4860 3592 rundll32.exe e57598a.exe PID 3592 wrote to memory of 4860 3592 rundll32.exe e57598a.exe PID 3592 wrote to memory of 4860 3592 rundll32.exe e57598a.exe PID 2352 wrote to memory of 776 2352 e573df3.exe fontdrvhost.exe PID 2352 wrote to memory of 784 2352 e573df3.exe fontdrvhost.exe PID 2352 wrote to memory of 332 2352 e573df3.exe dwm.exe PID 2352 wrote to memory of 2888 2352 e573df3.exe sihost.exe PID 2352 wrote to memory of 2900 2352 e573df3.exe svchost.exe PID 2352 wrote to memory of 3016 2352 e573df3.exe taskhostw.exe PID 2352 wrote to memory of 3436 2352 e573df3.exe Explorer.EXE PID 2352 wrote to memory of 3580 2352 e573df3.exe svchost.exe PID 2352 wrote to memory of 3760 2352 e573df3.exe DllHost.exe PID 2352 wrote to memory of 3852 2352 e573df3.exe StartMenuExperienceHost.exe PID 2352 wrote to memory of 3912 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 4000 2352 e573df3.exe SearchApp.exe PID 2352 wrote to memory of 696 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 3820 2352 e573df3.exe TextInputHost.exe PID 2352 wrote to memory of 1952 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 3428 2352 e573df3.exe backgroundTaskHost.exe PID 2352 wrote to memory of 2080 2352 e573df3.exe e574045.exe PID 2352 wrote to memory of 2080 2352 e573df3.exe e574045.exe PID 2352 wrote to memory of 2764 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 2092 2352 e573df3.exe RuntimeBroker.exe PID 2352 wrote to memory of 4860 2352 e573df3.exe e57598a.exe PID 2352 wrote to memory of 4860 2352 e573df3.exe e57598a.exe PID 4860 wrote to memory of 776 4860 e57598a.exe fontdrvhost.exe PID 4860 wrote to memory of 784 4860 e57598a.exe fontdrvhost.exe PID 4860 wrote to memory of 332 4860 e57598a.exe dwm.exe PID 4860 wrote to memory of 2888 4860 e57598a.exe sihost.exe PID 4860 wrote to memory of 2900 4860 e57598a.exe svchost.exe PID 4860 wrote to memory of 3016 4860 e57598a.exe taskhostw.exe PID 4860 wrote to memory of 3436 4860 e57598a.exe Explorer.EXE PID 4860 wrote to memory of 3580 4860 e57598a.exe svchost.exe PID 4860 wrote to memory of 3760 4860 e57598a.exe DllHost.exe PID 4860 wrote to memory of 3852 4860 e57598a.exe StartMenuExperienceHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e573df3.exee57598a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573df3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57598a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2900
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3016
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\71bf557af059e84b2393502a23035b10_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\e573df3.exeC:\Users\Admin\AppData\Local\Temp\e573df3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\e574045.exeC:\Users\Admin\AppData\Local\Temp\e574045.exe4⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\e57598a.exeC:\Users\Admin\AppData\Local\Temp\e57598a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4000
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:696
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1952
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3428
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1204
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2092
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e573df3.exeFilesize
97KB
MD5fae4bfd1175d7bed1e02a018c07537b0
SHA1f67698366b29359c2d442e05aa36a98b30f17a6b
SHA2566d24e447bbd40cdb4753cab916400bba25dc7a3257fb11f420cd238f7b1b546a
SHA51247665606f48be8d8e745f3efe6f814b3a916ae81dc81853968045061cee919234389b258f9b53cd924a93d981c1553f8b765c3e051a9941f4ecd189556e6274d
-
C:\Windows\SYSTEM.INIFilesize
257B
MD54d1bdbb9b4f086de64d7e4cd9368829c
SHA1b795ca541c95018835772b54abda7d2d5dd5a8b8
SHA2562524f6749654f4329f1440ee21010336a139e5f39949ddd235bcf490218a4d9f
SHA512ce906f0602811607d6450bee2970d77d1e8ad018cf36e72d9dc5e740980ff8a3c445325b369ec08e84f3d4d8624fa0a37cd1491d8b33ceb80862c79dc1d00381
-
memory/2080-36-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2080-118-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2080-59-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2080-61-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2080-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2352-53-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-78-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-31-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-35-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2352-32-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2352-20-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-18-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2352-24-0x00000000040F0000-0x00000000040F1000-memory.dmpFilesize
4KB
-
memory/2352-8-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-9-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-12-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-19-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-11-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-38-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-37-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-39-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-40-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-41-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-43-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-44-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-108-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2352-101-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-55-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-56-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-95-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2352-84-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-82-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-66-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-81-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-80-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-10-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-68-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-71-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-73-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-75-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-77-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/2352-28-0x00000000007E0000-0x000000000189A000-memory.dmpFilesize
16.7MB
-
memory/3592-29-0x0000000000A40000-0x0000000000A42000-memory.dmpFilesize
8KB
-
memory/3592-30-0x0000000003600000-0x0000000003601000-memory.dmpFilesize
4KB
-
memory/3592-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3592-21-0x0000000000A40000-0x0000000000A42000-memory.dmpFilesize
8KB
-
memory/3592-25-0x0000000000A40000-0x0000000000A42000-memory.dmpFilesize
8KB
-
memory/4860-62-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4860-65-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4860-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4860-52-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4860-129-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4860-154-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4860-155-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB