Analysis
- max time kernel
137s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f27dba2c62db27fa47a0c2689d85d10_NeikiAnalytics.dll
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
General
- Target 5f27dba2c62db27fa47a0c2689d85d10_NeikiAnalytics.dll
- Size 120KB
- Sample240519-dns64afd3x
- SHA256 8a17714c0f54562ee6c3a45c6aaf15849b85e811b3013ecbed151a7d3f853bf5
- MD5 5f27dba2c62db27fa47a0c2689d85d10
- SHA1 6b0dc4f2c5b35708e624252bc6df81f57e31fab0
- SHA512 43674c2ccbceb70b66371b5f102eaf757a56f23b43588b42900e28e525505a858bcb087885ab2579a1c81620e9c190b82a5568e2596894ecefdcce95a5565da0
- SSDEEP 1536:4Qyf7gV5kFNHRth7fU0xrz3BHQM7HRRjF6/NDjkGqntJ9EM2cquQ/T3nQm:4QyseF1/ZU0B35rw5kGqtJW3n
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576dbe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576dbe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574c3b.exe - Executes dropped EXE 3 IoCs
pid Process 4824 e574c3b.exe 4980 e574d84.exe 4376 e576dbe.exe -
resource yara_rule behavioral2/memory/4824-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-33-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-22-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-34-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-19-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-35-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-36-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-38-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-40-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-50-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-59-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-60-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-62-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-63-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-65-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-67-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-69-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-71-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-73-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4824-81-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4376-118-0x0000000000B60000-0x0000000001C1A000-memory.dmp upx behavioral2/memory/4376-147-0x0000000000B60000-0x0000000001C1A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576dbe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574c3b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576dbe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574c3b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576dbe.exe - Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e574c3b.exe File opened (read-only) \??\L: e574c3b.exe File opened (read-only) \??\M: e574c3b.exe File opened (read-only) \??\E: e576dbe.exe File opened (read-only) \??\H: e576dbe.exe File opened (read-only) \??\E: e574c3b.exe File opened (read-only) \??\G: e574c3b.exe File opened (read-only) \??\H: e574c3b.exe File opened (read-only) \??\G: e576dbe.exe File opened (read-only) \??\I: e574c3b.exe File opened (read-only) \??\K: e574c3b.exe File opened (read-only) \??\N: e574c3b.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e574d16 e574c3b.exe File opened for modification C:\Windows\SYSTEM.INI e574c3b.exe File created C:\Windows\e579ed0 e576dbe.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4824 e574c3b.exe 4824 e574c3b.exe 4824 e574c3b.exe 4824 e574c3b.exe 4376 e576dbe.exe 4376 e576dbe.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe Token: SeDebugPrivilege 4824 e574c3b.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 576 2444 rundll32.exe 83 PID 2444 wrote to memory of 576 2444 rundll32.exe 83 PID 2444 wrote to memory of 576 2444 rundll32.exe 83 PID 576 wrote to memory of 4824 576 rundll32.exe 84 PID 576 wrote to memory of 4824 576 rundll32.exe 84 PID 576 wrote to memory of 4824 576 rundll32.exe 84 PID 4824 wrote to memory of 772 4824 e574c3b.exe 8 PID 4824 wrote to memory of 776 4824 e574c3b.exe 9 PID 4824 wrote to memory of 316 4824 e574c3b.exe 13 PID 4824 wrote to memory of 2492 4824 e574c3b.exe 44 PID 4824 wrote to memory of 2592 4824 e574c3b.exe 45 PID 4824 wrote to memory of 2816 4824 e574c3b.exe 51 PID 4824 wrote to memory of 3368 4824 e574c3b.exe 56 PID 4824 wrote to memory of 3548 4824 e574c3b.exe 57 PID 4824 wrote to memory of 3732 4824 e574c3b.exe 58 PID 4824 wrote to memory of 3824 4824 e574c3b.exe 59 PID 4824 wrote to memory of 3892 4824 e574c3b.exe 60 PID 4824 wrote to memory of 4016 4824 e574c3b.exe 61 PID 4824 wrote to memory of 4060 4824 e574c3b.exe 62 PID 4824 wrote to memory of 2168 4824 e574c3b.exe 64 PID 4824 wrote to memory of 1292 4824 e574c3b.exe 75 PID 4824 wrote to memory of 4196 4824 e574c3b.exe 80 PID 4824 wrote to memory of 948 4824 e574c3b.exe 81 PID 4824 wrote to memory of 2444 4824 e574c3b.exe 82 PID 4824 wrote to memory of 576 4824 e574c3b.exe 83 PID 4824 wrote to memory of 576 4824 e574c3b.exe 83 PID 576 wrote to memory of 4980 576 rundll32.exe 85 PID 576 wrote to memory of 4980 576 rundll32.exe 85 PID 576 wrote to memory of 4980 576 rundll32.exe 85 PID 576 wrote to memory of 4376 576 rundll32.exe 89 PID 576 wrote to memory of 4376 576 rundll32.exe 89 PID 576 wrote to memory of 4376 576 rundll32.exe 89 PID 4824 wrote to memory of 772 4824 e574c3b.exe 8 PID 4824 wrote to memory of 776 4824 e574c3b.exe 9 PID 4824 wrote to memory of 316 4824 e574c3b.exe 13 PID 4824 wrote to memory of 2492 4824 e574c3b.exe 44 PID 4824 wrote to memory of 2592 4824 e574c3b.exe 45 PID 4824 wrote to memory of 2816 4824 e574c3b.exe 51 PID 4824 wrote to memory of 3368 4824 e574c3b.exe 56 PID 4824 wrote to memory of 3548 4824 e574c3b.exe 57 PID 4824 wrote to memory of 3732 4824 e574c3b.exe 58 PID 4824 wrote to memory of 3824 4824 e574c3b.exe 59 PID 4824 wrote to memory of 3892 4824 e574c3b.exe 60 PID 4824 wrote to memory of 4016 4824 e574c3b.exe 61 PID 4824 wrote to memory of 4060 4824 e574c3b.exe 62 PID 4824 wrote to memory of 2168 4824 e574c3b.exe 64 PID 4824 wrote to memory of 1292 4824 e574c3b.exe 75 PID 4824 wrote to memory of 4196 4824 e574c3b.exe 80 PID 4824 wrote to memory of 948 4824 e574c3b.exe 81 PID 4824 wrote to memory of 4980 4824 e574c3b.exe 85 PID 4824 wrote to memory of 4980 4824 e574c3b.exe 85 PID 4824 wrote to memory of 4280 4824 e574c3b.exe 87 PID 4824 wrote to memory of 5052 4824 e574c3b.exe 88 PID 4824 wrote to memory of 4376 4824 e574c3b.exe 89 PID 4824 wrote to memory of 4376 4824 e574c3b.exe 89 PID 4376 wrote to memory of 772 4376 e576dbe.exe 8 PID 4376 wrote to memory of 776 4376 e576dbe.exe 9 PID 4376 wrote to memory of 316 4376 e576dbe.exe 13 PID 4376 wrote to memory of 2492 4376 e576dbe.exe 44 PID 4376 wrote to memory of 2592 4376 e576dbe.exe 45 PID 4376 wrote to memory of 2816 4376 e576dbe.exe 51 PID 4376 wrote to memory of 3368 4376 e576dbe.exe 56 PID 4376 wrote to memory of 3548 4376 e576dbe.exe 57 PID 4376 wrote to memory of 3732 4376 e576dbe.exe 58 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574c3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576dbe.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2592
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2816
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3368
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f27dba2c62db27fa47a0c2689d85d10_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f27dba2c62db27fa47a0c2689d85d10_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\e574c3b.exeC:\Users\Admin\AppData\Local\Temp\e574c3b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\e574d84.exeC:\Users\Admin\AppData\Local\Temp\e574d84.exe4⤵
- Executes dropped EXE
PID:4980
-
-
C:\Users\Admin\AppData\Local\Temp\e576dbe.exeC:\Users\Admin\AppData\Local\Temp\e576dbe.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4376
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3548
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3824
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3892
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4060
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2168
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1292
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4196
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4280
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5052
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e574c3b.exe
- Size 97KB
- SHA256 591bc827ba3f42c33ec2782a421a2999043a5324d49b1c191ba890dafdad047e
- MD5 2019212b50ba882c33915d1c10b1f0c5
- SHA1 14bf539e38409f0acc70ab10a3eb8c35c3a44a70
- SHA512 5651267aa35be64dc946460bedcf5ce0f4b736b08259623a6c2f38984cd69a370c3efa48998e8945dcf6ad3fa86ba7a1a8d1dcb768f499c4b6f41e9ee9ce48b2
- SSDEEP 1536:gTLH76BsxFtNtE+rpPen4r7MPdgX/mJLO4716cIzfcMgZGszZF/:gbntE+bKp6cILcMgki
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 8e6f091fba44ced40e614726f422867f0806071b999473d362e973426ccad1f3
- MD5 afefd834007495107242fe6cb742061d
- SHA1 d99e9f5e4378cd9e8db35b41141b967e0f9acd47
- SHA512 95636ac4db38500e04bcea6d26a10a432b1a87c166b57dec3cb976fb9c4c9ba02667f9413b2d04792413b3ed3fd979975a7520cc1b7b9ee7f4a1aa13e254f086
- MD5 SHA1 SHA512