Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 13:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cff9cd0b86c004879f6b7531427adc70_NeikiAnalytics.dll
Resource
win7-20231129-en
windows7-x64
15 signatures
150 seconds
General
- Target cff9cd0b86c004879f6b7531427adc70_NeikiAnalytics.dll
- Size 120KB
- Sample240519-q8vxmsah75
- SHA256 48999ea27b785e20a46131a9949bcb8ec2cc0ba3121b46b0662f7d8cae2519fb
- MD5 cff9cd0b86c004879f6b7531427adc70
- SHA1 ffe712f93b238b4338c5e2c907880cedd87f49bc
- SHA512 deba332350e593de1c28ae87a46af226c5a1eb6a40cbbe02875eca1a5279400cc75e3658cde6ceff842434fd914586b25c3d5b20889d20f7d1ef5573a08ece88
- SSDEEP 3072:rX03NLm4wulNaEl0F7p78LXG2mi9Jx88bWdI9fdMW:jYNH70FpgLXG251CdIBX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577649.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57490f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57490f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577649.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577649.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577649.exe - Executes dropped EXE 3 IoCs
pid Process 1500 e57490f.exe 4428 e574a28.exe 3252 e577649.exe -
resource yara_rule behavioral2/memory/1500-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-6-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-25-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-27-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-31-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-34-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-36-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-35-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-38-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-39-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-53-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-54-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-55-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-56-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-59-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-60-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-63-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-64-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-67-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/1500-69-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3252-103-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3252-147-0x0000000000850000-0x000000000190A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57490f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57490f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57490f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57490f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577649.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: e57490f.exe File opened (read-only) \??\I: e577649.exe File opened (read-only) \??\J: e577649.exe File opened (read-only) \??\E: e57490f.exe File opened (read-only) \??\G: e57490f.exe File opened (read-only) \??\I: e57490f.exe File opened (read-only) \??\J: e57490f.exe File opened (read-only) \??\K: e57490f.exe File opened (read-only) \??\H: e577649.exe File opened (read-only) \??\H: e57490f.exe File opened (read-only) \??\M: e57490f.exe File opened (read-only) \??\N: e57490f.exe File opened (read-only) \??\E: e577649.exe File opened (read-only) \??\G: e577649.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57495d e57490f.exe File opened for modification C:\Windows\SYSTEM.INI e57490f.exe File created C:\Windows\e579d98 e577649.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1500 e57490f.exe 1500 e57490f.exe 1500 e57490f.exe 1500 e57490f.exe 3252 e577649.exe 3252 e577649.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe Token: SeDebugPrivilege 1500 e57490f.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4632 wrote to memory of 2212 4632 rundll32.exe 82 PID 4632 wrote to memory of 2212 4632 rundll32.exe 82 PID 4632 wrote to memory of 2212 4632 rundll32.exe 82 PID 2212 wrote to memory of 1500 2212 rundll32.exe 83 PID 2212 wrote to memory of 1500 2212 rundll32.exe 83 PID 2212 wrote to memory of 1500 2212 rundll32.exe 83 PID 1500 wrote to memory of 800 1500 e57490f.exe 9 PID 1500 wrote to memory of 808 1500 e57490f.exe 10 PID 1500 wrote to memory of 380 1500 e57490f.exe 13 PID 1500 wrote to memory of 2584 1500 e57490f.exe 44 PID 1500 wrote to memory of 2628 1500 e57490f.exe 45 PID 1500 wrote to memory of 2820 1500 e57490f.exe 50 PID 1500 wrote to memory of 3352 1500 e57490f.exe 55 PID 1500 wrote to memory of 3536 1500 e57490f.exe 57 PID 1500 wrote to memory of 3748 1500 e57490f.exe 58 PID 1500 wrote to memory of 3840 1500 e57490f.exe 59 PID 1500 wrote to memory of 3908 1500 e57490f.exe 60 PID 1500 wrote to memory of 4040 1500 e57490f.exe 61 PID 1500 wrote to memory of 4136 1500 e57490f.exe 62 PID 1500 wrote to memory of 1720 1500 e57490f.exe 73 PID 1500 wrote to memory of 4848 1500 e57490f.exe 74 PID 1500 wrote to memory of 1776 1500 e57490f.exe 79 PID 1500 wrote to memory of 3588 1500 e57490f.exe 80 PID 1500 wrote to memory of 4632 1500 e57490f.exe 81 PID 1500 wrote to memory of 2212 1500 e57490f.exe 82 PID 1500 wrote to memory of 2212 1500 e57490f.exe 82 PID 2212 wrote to memory of 4428 2212 rundll32.exe 84 PID 2212 wrote to memory of 4428 2212 rundll32.exe 84 PID 2212 wrote to memory of 4428 2212 rundll32.exe 84 PID 1500 wrote to memory of 800 1500 e57490f.exe 9 PID 1500 wrote to memory of 808 1500 e57490f.exe 10 PID 1500 wrote to memory of 380 1500 e57490f.exe 13 PID 1500 wrote to memory of 2584 1500 e57490f.exe 44 PID 1500 wrote to memory of 2628 1500 e57490f.exe 45 PID 1500 wrote to memory of 2820 1500 e57490f.exe 50 PID 1500 wrote to memory of 3352 1500 e57490f.exe 55 PID 1500 wrote to memory of 3536 1500 e57490f.exe 57 PID 1500 wrote to memory of 3748 1500 e57490f.exe 58 PID 1500 wrote to memory of 3840 1500 e57490f.exe 59 PID 1500 wrote to memory of 3908 1500 e57490f.exe 60 PID 1500 wrote to memory of 4040 1500 e57490f.exe 61 PID 1500 wrote to memory of 4136 1500 e57490f.exe 62 PID 1500 wrote to memory of 1720 1500 e57490f.exe 73 PID 1500 wrote to memory of 4848 1500 e57490f.exe 74 PID 1500 wrote to memory of 1776 1500 e57490f.exe 79 PID 1500 wrote to memory of 3588 1500 e57490f.exe 80 PID 1500 wrote to memory of 4632 1500 e57490f.exe 81 PID 1500 wrote to memory of 4428 1500 e57490f.exe 84 PID 1500 wrote to memory of 4428 1500 e57490f.exe 84 PID 1500 wrote to memory of 2156 1500 e57490f.exe 86 PID 1500 wrote to memory of 3384 1500 e57490f.exe 87 PID 2212 wrote to memory of 3252 2212 rundll32.exe 93 PID 2212 wrote to memory of 3252 2212 rundll32.exe 93 PID 2212 wrote to memory of 3252 2212 rundll32.exe 93 PID 3252 wrote to memory of 800 3252 e577649.exe 9 PID 3252 wrote to memory of 808 3252 e577649.exe 10 PID 3252 wrote to memory of 380 3252 e577649.exe 13 PID 3252 wrote to memory of 2584 3252 e577649.exe 44 PID 3252 wrote to memory of 2628 3252 e577649.exe 45 PID 3252 wrote to memory of 2820 3252 e577649.exe 50 PID 3252 wrote to memory of 3352 3252 e577649.exe 55 PID 3252 wrote to memory of 3536 3252 e577649.exe 57 PID 3252 wrote to memory of 3748 3252 e577649.exe 58 PID 3252 wrote to memory of 3840 3252 e577649.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577649.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57490f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2628
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2820
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3352
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cff9cd0b86c004879f6b7531427adc70_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cff9cd0b86c004879f6b7531427adc70_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\e57490f.exeC:\Users\Admin\AppData\Local\Temp\e57490f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1500
-
-
C:\Users\Admin\AppData\Local\Temp\e574a28.exeC:\Users\Admin\AppData\Local\Temp\e574a28.exe4⤵
- Executes dropped EXE
PID:4428
-
-
C:\Users\Admin\AppData\Local\Temp\e577649.exeC:\Users\Admin\AppData\Local\Temp\e577649.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3252
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3536
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1720
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4848
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1776
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3588
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2156
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3384
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e57490f.exe
- Size 97KB
- SHA256 23c94a11423a03c04844f283c908e6b7c0ba5e9faeeb3a584ef08ead67d53eb5
- MD5 64c2034b064c8c2a30d651ff5a11c8c4
- SHA1 d888296820f8120c0d83a32862e7810aafc156f5
- SHA512 a44fa3fcbb444cb6d1cba333e51b09d16ccd7bc37d928b231a1abfe5245a5b732ae002690b3c45b857e1466343a6545845a797181fccb666ec7b663934848b9e
- SSDEEP 1536:rKHgvElYLYXg4N1ACbY0hf82y6YHCRXd0mXJrF/ob0Kqc0St+PiweOsvA1dApcsV:uA0N1AOjpVtNXSgbkoevo6p+o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 c14049d812e9bf42612b0eb7532023cebedac0623283299642f4a9b15da13e33
- MD5 4681a6848464bb99b4740ef883187621
- SHA1 643c42baff1d040d79208d1281b4f836fd1f020e
- SHA512 54c33438ffc1686ce1ca60d8ca6cd4231d24b47d9d87098ef0eccd18983a5055016047223a621943f985676972fa80d7caa9fdcc0f7a42982d2d13cbff52265b
- MD5 SHA1 SHA512