Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 06:58
Static task
static1
Behavioral task
behavioral1
Sample
a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
a7b2df41f56f1e1862a40c2f995b23b0
-
SHA1
bc691751b27754c80b4663b0d8fa4fc1bf073c17
-
SHA256
f4828eee64fe3ca22473db49a49e4ce69848cb07e8f439ffac2eb38290ea3754
-
SHA512
86d0e5136695bff4777025f923bcabaae316e06084183fa859a8929bc750279f2e55bc17772d67100a83a2aa579d50e6790e86c6ea413bd9c3240b4fbf99e29f
-
SSDEEP
1536:AHGuKM2xLdnkNVq8llMQ5gCC8CGugXWRJbIuUwM+U3kZMBGZxNEbSHkRDx:n2l6CBvdeUupUBeUbSHU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e573633.exee5751f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573633.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573633.exe -
Processes:
e573633.exee5751f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5751f8.exe -
Processes:
e573633.exee5751f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5751f8.exe -
Executes dropped EXE 4 IoCs
Processes:
e573633.exee5737b9.exee5751f8.exee575217.exepid process 3840 e573633.exe 2460 e5737b9.exe 4884 e5751f8.exe 1688 e575217.exe -
Processes:
resource yara_rule behavioral2/memory/3840-8-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-11-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-20-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-27-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-19-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-12-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-18-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-10-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-6-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-32-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-36-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-37-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-38-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-40-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-39-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-42-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-43-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-57-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-59-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-60-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-74-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-76-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-79-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-81-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-83-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-85-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-87-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-88-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-95-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-96-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/3840-100-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/4884-133-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4884-169-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e573633.exee5751f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573633.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5751f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5751f8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5751f8.exe -
Processes:
e573633.exee5751f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5751f8.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e573633.exee5751f8.exedescription ioc process File opened (read-only) \??\J: e573633.exe File opened (read-only) \??\M: e573633.exe File opened (read-only) \??\E: e573633.exe File opened (read-only) \??\H: e573633.exe File opened (read-only) \??\R: e573633.exe File opened (read-only) \??\G: e573633.exe File opened (read-only) \??\L: e573633.exe File opened (read-only) \??\Q: e573633.exe File opened (read-only) \??\S: e573633.exe File opened (read-only) \??\E: e5751f8.exe File opened (read-only) \??\G: e5751f8.exe File opened (read-only) \??\I: e573633.exe File opened (read-only) \??\K: e573633.exe File opened (read-only) \??\N: e573633.exe File opened (read-only) \??\O: e573633.exe File opened (read-only) \??\P: e573633.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e573633.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e573633.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573633.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573633.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e573633.exe -
Drops file in Windows directory 3 IoCs
Processes:
e573633.exee5751f8.exedescription ioc process File created C:\Windows\e573691 e573633.exe File opened for modification C:\Windows\SYSTEM.INI e573633.exe File created C:\Windows\e5786f3 e5751f8.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e573633.exee5751f8.exepid process 3840 e573633.exe 3840 e573633.exe 3840 e573633.exe 3840 e573633.exe 4884 e5751f8.exe 4884 e5751f8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e573633.exedescription pid process Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe Token: SeDebugPrivilege 3840 e573633.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee573633.exee5751f8.exedescription pid process target process PID 3648 wrote to memory of 3452 3648 rundll32.exe rundll32.exe PID 3648 wrote to memory of 3452 3648 rundll32.exe rundll32.exe PID 3648 wrote to memory of 3452 3648 rundll32.exe rundll32.exe PID 3452 wrote to memory of 3840 3452 rundll32.exe e573633.exe PID 3452 wrote to memory of 3840 3452 rundll32.exe e573633.exe PID 3452 wrote to memory of 3840 3452 rundll32.exe e573633.exe PID 3840 wrote to memory of 772 3840 e573633.exe fontdrvhost.exe PID 3840 wrote to memory of 780 3840 e573633.exe fontdrvhost.exe PID 3840 wrote to memory of 68 3840 e573633.exe dwm.exe PID 3840 wrote to memory of 2772 3840 e573633.exe sihost.exe PID 3840 wrote to memory of 2844 3840 e573633.exe svchost.exe PID 3840 wrote to memory of 3016 3840 e573633.exe taskhostw.exe PID 3840 wrote to memory of 3408 3840 e573633.exe Explorer.EXE PID 3840 wrote to memory of 3520 3840 e573633.exe svchost.exe PID 3840 wrote to memory of 3704 3840 e573633.exe DllHost.exe PID 3840 wrote to memory of 3788 3840 e573633.exe StartMenuExperienceHost.exe PID 3840 wrote to memory of 3864 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 3948 3840 e573633.exe SearchApp.exe PID 3840 wrote to memory of 3828 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 4112 3840 e573633.exe TextInputHost.exe PID 3840 wrote to memory of 3088 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 1480 3840 e573633.exe backgroundTaskHost.exe PID 3840 wrote to memory of 4808 3840 e573633.exe backgroundTaskHost.exe PID 3840 wrote to memory of 3648 3840 e573633.exe rundll32.exe PID 3840 wrote to memory of 3452 3840 e573633.exe rundll32.exe PID 3840 wrote to memory of 3452 3840 e573633.exe rundll32.exe PID 3452 wrote to memory of 2460 3452 rundll32.exe e5737b9.exe PID 3452 wrote to memory of 2460 3452 rundll32.exe e5737b9.exe PID 3452 wrote to memory of 2460 3452 rundll32.exe e5737b9.exe PID 3452 wrote to memory of 4884 3452 rundll32.exe e5751f8.exe PID 3452 wrote to memory of 4884 3452 rundll32.exe e5751f8.exe PID 3452 wrote to memory of 4884 3452 rundll32.exe e5751f8.exe PID 3452 wrote to memory of 1688 3452 rundll32.exe e575217.exe PID 3452 wrote to memory of 1688 3452 rundll32.exe e575217.exe PID 3452 wrote to memory of 1688 3452 rundll32.exe e575217.exe PID 3840 wrote to memory of 772 3840 e573633.exe fontdrvhost.exe PID 3840 wrote to memory of 780 3840 e573633.exe fontdrvhost.exe PID 3840 wrote to memory of 68 3840 e573633.exe dwm.exe PID 3840 wrote to memory of 2772 3840 e573633.exe sihost.exe PID 3840 wrote to memory of 2844 3840 e573633.exe svchost.exe PID 3840 wrote to memory of 3016 3840 e573633.exe taskhostw.exe PID 3840 wrote to memory of 3408 3840 e573633.exe Explorer.EXE PID 3840 wrote to memory of 3520 3840 e573633.exe svchost.exe PID 3840 wrote to memory of 3704 3840 e573633.exe DllHost.exe PID 3840 wrote to memory of 3788 3840 e573633.exe StartMenuExperienceHost.exe PID 3840 wrote to memory of 3864 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 3948 3840 e573633.exe SearchApp.exe PID 3840 wrote to memory of 3828 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 4112 3840 e573633.exe TextInputHost.exe PID 3840 wrote to memory of 3088 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 1480 3840 e573633.exe backgroundTaskHost.exe PID 3840 wrote to memory of 2460 3840 e573633.exe e5737b9.exe PID 3840 wrote to memory of 2460 3840 e573633.exe e5737b9.exe PID 3840 wrote to memory of 808 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 4548 3840 e573633.exe RuntimeBroker.exe PID 3840 wrote to memory of 4884 3840 e573633.exe e5751f8.exe PID 3840 wrote to memory of 4884 3840 e573633.exe e5751f8.exe PID 3840 wrote to memory of 1688 3840 e573633.exe e575217.exe PID 3840 wrote to memory of 1688 3840 e573633.exe e575217.exe PID 4884 wrote to memory of 772 4884 e5751f8.exe fontdrvhost.exe PID 4884 wrote to memory of 780 4884 e5751f8.exe fontdrvhost.exe PID 4884 wrote to memory of 68 4884 e5751f8.exe dwm.exe PID 4884 wrote to memory of 2772 4884 e5751f8.exe sihost.exe PID 4884 wrote to memory of 2844 4884 e5751f8.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e573633.exee5751f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573633.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5751f8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:68
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2844
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3016
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a7b2df41f56f1e1862a40c2f995b23b0_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\e573633.exeC:\Users\Admin\AppData\Local\Temp\e573633.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\e5737b9.exeC:\Users\Admin\AppData\Local\Temp\e5737b9.exe4⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\e5751f8.exeC:\Users\Admin\AppData\Local\Temp\e5751f8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\e575217.exeC:\Users\Admin\AppData\Local\Temp\e575217.exe4⤵
- Executes dropped EXE
PID:1688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3520
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3704
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3788
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3828
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4112
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3088
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1480
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4808
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:808
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e573633.exeFilesize
97KB
MD52dfe678f9674d3fc21bcb4e680f3b7d5
SHA1ce44876399f8d9f377f8b4fbaf3d88f3b8bf02b0
SHA256369197c45a5ec10aed193472aaabb1d80afed2e0bb8642a75d1306e153f733d7
SHA512b49175b7d43fda011a129508daa2227ab43975fd21a1e66a5ad31b0b076ff2fde2165245fce2ae5ec1c293f04029a940f4e545c03a4df12eb8a042b72c28bb81
-
C:\Windows\SYSTEM.INIFilesize
257B
MD56ee54fcddbf4c476fa7e18ef07ea31e0
SHA1167aeefd3090198be36a933800404ae42254d7bd
SHA256a211253cae04040a3ca4dafa143707072b9a1f760c9c6784eb2c0245c18e31d7
SHA5124af3b003487659d73c1c15673c7ea1e0b3762f291cd2f6f51a516687e2159c92f76a3fce092c1c0c6377c22d14e79d2df844450b54fd43b933eb8926ad971b83
-
memory/1688-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1688-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1688-168-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1688-69-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1688-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2460-121-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2460-63-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2460-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2460-35-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2460-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3452-25-0x00000000035E0000-0x00000000035E2000-memory.dmpFilesize
8KB
-
memory/3452-53-0x00000000035E0000-0x00000000035E2000-memory.dmpFilesize
8KB
-
memory/3452-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3452-22-0x0000000003C00000-0x0000000003C01000-memory.dmpFilesize
4KB
-
memory/3452-21-0x00000000035E0000-0x00000000035E2000-memory.dmpFilesize
8KB
-
memory/3452-29-0x00000000035E0000-0x00000000035E2000-memory.dmpFilesize
8KB
-
memory/3840-57-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-87-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-32-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-36-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-37-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-38-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-40-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-39-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-42-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-43-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-10-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-18-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3840-24-0x00000000040F0000-0x00000000040F1000-memory.dmpFilesize
4KB
-
memory/3840-59-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-60-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-12-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-28-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/3840-8-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-19-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-27-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-11-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-117-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3840-30-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/3840-20-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-74-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-76-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-79-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-81-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-83-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-85-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-6-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-88-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-94-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/3840-95-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-96-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/3840-100-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/4884-66-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4884-67-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4884-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4884-133-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4884-49-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4884-169-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4884-170-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB