Analysis
-
max time kernel
10s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe
-
Size
732KB
-
MD5
3b94744c1af3863468425acb2d086870
-
SHA1
e8e04d433b325e7c6f7375ed90eb6f44bddb4a50
-
SHA256
7286faa87d9761ae37f4cd3122865b829f2cab42eff87a3ffba01047929e508a
-
SHA512
bf12103aa593d6a4d5fa8325c22f26487b718865c278dc1a740780490c6ac1438db082bfbfcf1847be18c449076c4cc3db7c1289a2104f84863cac348ca639e7
-
SSDEEP
12288:ITyjXW+48qWywrU4kGFezOAVuJ5PIqww7F5DO3HYff8vt8nF:GIXW/8yw1ez54lIUF5SXYH0+nF
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
rundll32.exe3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 2564 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exepid process 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/1948-1-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-13-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-5-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-10-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-3-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-8-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-9-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-7-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-6-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-4-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-37-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/1948-38-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/2564-69-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-67-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-70-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-71-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-63-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-72-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-68-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-66-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-65-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-61-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/1948-60-0x00000000026C0000-0x000000000377A000-memory.dmp upx behavioral1/memory/2564-64-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-97-0x0000000002790000-0x000000000384A000-memory.dmp upx behavioral1/memory/2564-148-0x0000000002790000-0x000000000384A000-memory.dmp upx -
Processes:
rundll32.exe3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe -
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\U: rundll32.exe -
Drops file in Windows directory 3 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process File created C:\Windows\f76165e 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe File created C:\Windows\f761fa1 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exepid process 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 2564 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription pid process Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe Token: SeDebugPrivilege 2564 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exepid process 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe 2564 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription pid process target process PID 1948 wrote to memory of 1104 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe taskhost.exe PID 1948 wrote to memory of 1152 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Dwm.exe PID 1948 wrote to memory of 1196 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Explorer.EXE PID 1948 wrote to memory of 908 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe DllHost.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 1948 wrote to memory of 2564 1948 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe rundll32.exe PID 2564 wrote to memory of 1104 2564 rundll32.exe taskhost.exe PID 2564 wrote to memory of 1152 2564 rundll32.exe Dwm.exe PID 2564 wrote to memory of 1196 2564 rundll32.exe Explorer.EXE PID 2564 wrote to memory of 908 2564 rundll32.exe DllHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
3b94744c1af3863468425acb2d086870_NeikiAnalytics.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b94744c1af3863468425acb2d086870_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
8Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0F7621F2_Rar\rundll32.exeFilesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeFilesize
732KB
MD53b94744c1af3863468425acb2d086870
SHA1e8e04d433b325e7c6f7375ed90eb6f44bddb4a50
SHA2567286faa87d9761ae37f4cd3122865b829f2cab42eff87a3ffba01047929e508a
SHA512bf12103aa593d6a4d5fa8325c22f26487b718865c278dc1a740780490c6ac1438db082bfbfcf1847be18c449076c4cc3db7c1289a2104f84863cac348ca639e7
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5b70db86dc0fb51fe274ed12bf906d31e
SHA1394969f808409c83df314dcc5552129b36279b68
SHA2566523f79c11bba29cda0cb9fb454baa1915e9ac16b3d026360e505285919068bd
SHA51266fb7b4d3f058dc56eed29660a2e7a75bd796fed4626a09f43aed609e825b11261be4ee0636c43815f143161e53e246427d8cfe7aa0b8b5155ba88ee4c3913e5
-
memory/1104-20-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/1948-8-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-9-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-29-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/1948-32-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1948-5-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-34-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/1948-10-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-3-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-33-0x00000000001D0000-0x00000000001D2000-memory.dmpFilesize
8KB
-
memory/1948-30-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1948-7-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-6-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-4-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-37-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-38-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-13-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-0-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/1948-58-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/1948-60-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/1948-1-0x00000000026C0000-0x000000000377A000-memory.dmpFilesize
16.7MB
-
memory/2564-67-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-91-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2564-90-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2564-63-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-72-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-68-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-66-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-65-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-95-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2564-61-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-71-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-64-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-59-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/2564-70-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-69-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-97-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB
-
memory/2564-148-0x0000000002790000-0x000000000384A000-memory.dmpFilesize
16.7MB