dcrat | 0e31f2eb414aeb213e3277af70dbd34840d6232a486b3f6a4fd6526ed7f6286c

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Size 2.9MB
Sample240519-rcz26abc4t
SHA256 0e31f2eb414aeb213e3277af70dbd34840d6232a486b3f6a4fd6526ed7f6286c
MD5 d17ae00f44e29422af960ea35c468610
SHA1 75ccfc65d62d89361564db2a01107264ba16ef5a
SHA512 905e9797d2b0b6c83f1a6e24d8af9ff928712e40651fe3ce649a38d5f40f464fbe7be0bf94ed44066509355a87e336c356cf11c3d7e1534c42202b124f07a414
SSDEEP 49152:/4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:wDKmzjWnC8Wikx1DUN2/Uq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	3904	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	3904	schtasks.exe	82

UAC bypass 3 TTPs 45 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2968-1-0x0000000000BD0000-0x0000000000EB6000-memory.dmp	dcrat
behavioral2/files/0x00070000000233f0-36.dat	dcrat
behavioral2/files/0x000a000000023400-152.dat	dcrat
behavioral2/files/0x0008000000023424-314.dat	dcrat
behavioral2/memory/1204-316-0x0000000000C30000-0x0000000000F16000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
432	powershell.exe
1008	powershell.exe
860	powershell.exe
1136	powershell.exe
4872	powershell.exe
3236	powershell.exe
4904	powershell.exe
4932	powershell.exe
1188	powershell.exe
908	powershell.exe
1916	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 14 IoCs

pid	Process
1204	dllhost.exe
1940	dllhost.exe
3256	dllhost.exe
3784	dllhost.exe
3620	dllhost.exe
3652	dllhost.exe
3732	dllhost.exe
732	dllhost.exe
2896	dllhost.exe
3828	dllhost.exe
2076	dllhost.exe
4832	dllhost.exe
1524	dllhost.exe
4788	dllhost.exe

Checks whether UAC is enabled 1 TTPs 30 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\upfc.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files (x86)\MSBuild\SppExtComObj.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files (x86)\MSBuild\e1ef82546f0b02	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\it-IT\dllhost.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\it-IT\5940a34987c991	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Defender\ea1d8f6d871115	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Multimedia Platform\winlogon.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCX6BAB.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\winlogon.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\csrss.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\121e5b5079f7c0	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\MSBuild\SppExtComObj.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX7CDA.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\lsass.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\RCX78D1.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX876E.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Multimedia Platform\cc11b995f2a76d	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\lsass.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\sysmon.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\6203df4a6bafc7	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\f3b6ecef712a24	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\RCX8973.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Security\BrowserCore\csrss.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\sysmon.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCX8569.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCX8FFD.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Program Files\Windows Security\BrowserCore\886983d96e3d3e	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\dllhost.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\RCX6FC4.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\upfc.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\9e8d7a4ca61bd9	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\StartMenuExperienceHost.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\5d17d4212663bc	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\Downloaded Program Files\RuntimeBroker.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX71C9.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\Vss\Writers\System\RCX73DD.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\Vss\Writers\System\spoolsv.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ityuxhost.resources_31bf3856ad364e35_10.0.19041.1_en-us_750174b4c66fb8a4\SearchApp.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCX6DC0.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\55b276f4edf653	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.964_lt-lt_b6b0c2e496a2db80\RuntimeBroker.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\Vss\Writers\System\f3b6ecef712a24	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\Vss\Writers\System\spoolsv.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\RCX765F.tmp	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\RuntimeBroker.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\StartMenuExperienceHost.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2432	schtasks.exe
2888	schtasks.exe
1160	schtasks.exe
4428	schtasks.exe
3988	schtasks.exe
3536	schtasks.exe
1856	schtasks.exe
2196	schtasks.exe
4480	schtasks.exe
2704	schtasks.exe
3508	schtasks.exe
2380	schtasks.exe
3900	schtasks.exe
1104	schtasks.exe
2512	schtasks.exe
4076	schtasks.exe
1340	schtasks.exe
4092	schtasks.exe
4916	schtasks.exe
4888	schtasks.exe
548	schtasks.exe
4952	schtasks.exe
508	schtasks.exe
3964	schtasks.exe
1360	schtasks.exe
2652	schtasks.exe
4152	schtasks.exe
1252	schtasks.exe
3284	schtasks.exe
3256	schtasks.exe
4612	schtasks.exe
1660	schtasks.exe
3676	schtasks.exe
3052	schtasks.exe
624	schtasks.exe
1664	schtasks.exe
4880	schtasks.exe
4704	schtasks.exe
1772	schtasks.exe
3268	schtasks.exe
3748	schtasks.exe
3828	schtasks.exe
1968	schtasks.exe
2040	schtasks.exe
4868	schtasks.exe
1484	schtasks.exe
3752	schtasks.exe
2080	schtasks.exe
3112	schtasks.exe
1680	schtasks.exe
2060	schtasks.exe
1964	schtasks.exe
552	schtasks.exe
3224	schtasks.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
1136	powershell.exe
1136	powershell.exe
908	powershell.exe
908	powershell.exe
3236	powershell.exe
3236	powershell.exe
1916	powershell.exe
1916	powershell.exe
1008	powershell.exe
1008	powershell.exe
1188	powershell.exe
1188	powershell.exe
4904	powershell.exe
4904	powershell.exe
432	powershell.exe
432	powershell.exe
4932	powershell.exe
4932	powershell.exe
4872	powershell.exe
4872	powershell.exe
432	powershell.exe
860	powershell.exe
860	powershell.exe
4872	powershell.exe
860	powershell.exe
1136	powershell.exe
908	powershell.exe
1916	powershell.exe
4904	powershell.exe
3236	powershell.exe
1008	powershell.exe
1188	powershell.exe
4932	powershell.exe
1204	dllhost.exe
1940	dllhost.exe
3256	dllhost.exe
3784	dllhost.exe
3620	dllhost.exe
3652	dllhost.exe
3732	dllhost.exe
732	dllhost.exe
2896	dllhost.exe
3828	dllhost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	4904	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	1204	dllhost.exe
Token: SeDebugPrivilege	1940	dllhost.exe
Token: SeDebugPrivilege	3256	dllhost.exe
Token: SeDebugPrivilege	3784	dllhost.exe
Token: SeDebugPrivilege	3620	dllhost.exe
Token: SeDebugPrivilege	3652	dllhost.exe
Token: SeDebugPrivilege	3732	dllhost.exe
Token: SeDebugPrivilege	732	dllhost.exe
Token: SeDebugPrivilege	2896	dllhost.exe
Token: SeDebugPrivilege	3828	dllhost.exe
Token: SeDebugPrivilege	2076	dllhost.exe
Token: SeDebugPrivilege	4832	dllhost.exe
Token: SeDebugPrivilege	1524	dllhost.exe
Token: SeDebugPrivilege	4788	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1008	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	143
PID 2968 wrote to memory of 1008	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	143
PID 2968 wrote to memory of 860	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	144
PID 2968 wrote to memory of 860	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	144
PID 2968 wrote to memory of 1188	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	145
PID 2968 wrote to memory of 1188	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	145
PID 2968 wrote to memory of 1136	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	146
PID 2968 wrote to memory of 1136	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	146
PID 2968 wrote to memory of 908	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	147
PID 2968 wrote to memory of 908	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	147
PID 2968 wrote to memory of 4872	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	148
PID 2968 wrote to memory of 4872	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	148
PID 2968 wrote to memory of 3236	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	149
PID 2968 wrote to memory of 3236	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	149
PID 2968 wrote to memory of 1916	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	150
PID 2968 wrote to memory of 1916	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	150
PID 2968 wrote to memory of 4904	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	151
PID 2968 wrote to memory of 4904	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	151
PID 2968 wrote to memory of 4932	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	152
PID 2968 wrote to memory of 4932	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	152
PID 2968 wrote to memory of 432	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	153
PID 2968 wrote to memory of 432	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	153
PID 2968 wrote to memory of 2812	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	165
PID 2968 wrote to memory of 2812	2968	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe	165
PID 2812 wrote to memory of 2000	2812	cmd.exe	167
PID 2812 wrote to memory of 2000	2812	cmd.exe	167
PID 2812 wrote to memory of 1204	2812	cmd.exe	168
PID 2812 wrote to memory of 1204	2812	cmd.exe	168
PID 1204 wrote to memory of 3396	1204	dllhost.exe	169
PID 1204 wrote to memory of 3396	1204	dllhost.exe	169
PID 1204 wrote to memory of 1516	1204	dllhost.exe	170
PID 1204 wrote to memory of 1516	1204	dllhost.exe	170
PID 3396 wrote to memory of 1940	3396	WScript.exe	172
PID 3396 wrote to memory of 1940	3396	WScript.exe	172
PID 1940 wrote to memory of 428	1940	dllhost.exe	173
PID 1940 wrote to memory of 428	1940	dllhost.exe	173
PID 1940 wrote to memory of 1272	1940	dllhost.exe	174
PID 1940 wrote to memory of 1272	1940	dllhost.exe	174
PID 428 wrote to memory of 3256	428	WScript.exe	175
PID 428 wrote to memory of 3256	428	WScript.exe	175
PID 3256 wrote to memory of 4952	3256	dllhost.exe	176
PID 3256 wrote to memory of 4952	3256	dllhost.exe	176
PID 3256 wrote to memory of 3268	3256	dllhost.exe	177
PID 3256 wrote to memory of 3268	3256	dllhost.exe	177
PID 4952 wrote to memory of 3784	4952	WScript.exe	178
PID 4952 wrote to memory of 3784	4952	WScript.exe	178
PID 3784 wrote to memory of 4820	3784	dllhost.exe	179
PID 3784 wrote to memory of 4820	3784	dllhost.exe	179
PID 3784 wrote to memory of 392	3784	dllhost.exe	180
PID 3784 wrote to memory of 392	3784	dllhost.exe	180
PID 4820 wrote to memory of 3620	4820	WScript.exe	181
PID 4820 wrote to memory of 3620	4820	WScript.exe	181
PID 3620 wrote to memory of 4376	3620	dllhost.exe	182
PID 3620 wrote to memory of 4376	3620	dllhost.exe	182
PID 3620 wrote to memory of 1776	3620	dllhost.exe	183
PID 3620 wrote to memory of 1776	3620	dllhost.exe	183
PID 4376 wrote to memory of 3652	4376	WScript.exe	184
PID 4376 wrote to memory of 3652	4376	WScript.exe	184
PID 3652 wrote to memory of 2024	3652	dllhost.exe	185
PID 3652 wrote to memory of 2024	3652	dllhost.exe	185
PID 3652 wrote to memory of 4284	3652	dllhost.exe	186
PID 3652 wrote to memory of 4284	3652	dllhost.exe	186
PID 2024 wrote to memory of 3732	2024	WScript.exe	187
PID 2024 wrote to memory of 3732	2024	WScript.exe	187

System policy modification 1 TTPs 45 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fw4F37BOSV.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2000
- - C:\Users\Default User\dllhost.exe
    "C:\Users\Default User\dllhost.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1204
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a491ac8-96c3-4966-85f3-c8efc81f417c.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1940
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\021e0748-c0b4-4c57-908e-bcc986803de8.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3256
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c7e08aa-20a1-4296-9755-9a4b093f0fec.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dbfd9b14-a782-4fa5-8235-d783e094cf43.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\772a891e-4db1-41cb-b3f0-6ca4ecf952c6.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c818e6da-4fb0-4016-b0f8-863325bd0850.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\804beaa1-2191-4c08-a49d-a5a3c2e8b8c7.vbs"
        16⤵
        
        PID:4844
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f579efe7-da4c-43ce-a6d5-fb4405a8193f.vbs"
        18⤵
        
        PID:5060
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f7b8fcc-ac92-47e6-b54d-cdacbd35e79e.vbs"
        20⤵
        
        PID:2072
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:3828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96e94b00-5e1b-4bbb-b850-f24cc86d92cd.vbs"
        22⤵
        
        PID:1568
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        23⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\445bd404-251c-4f23-a3fd-c0434fbf4f35.vbs"
        24⤵
        
        PID:664
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        25⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c1c7024-411e-4667-ac7f-3143b81c64a7.vbs"
        26⤵
        
        PID:1096
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        27⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf81a45f-dc21-4998-a9bf-0a3b521a05d1.vbs"
        28⤵
        
        PID:1484
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        29⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:4788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a352d189-482c-4b02-93b8-fa458061501f.vbs"
        30⤵
        
        PID:3188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee937f5b-581e-4a84-91a9-9cfd5bc792a1.vbs"
        30⤵
        
        PID:4120
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd34f1fb-036b-4505-9866-3cea2af4a306.vbs"
        28⤵
        
        PID:2436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe018698-9e53-4c15-b4fa-d98c86579d74.vbs"
        26⤵
        
        PID:4172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7fa08be7-2384-4c82-a81e-6d57d69d6f3e.vbs"
        24⤵
        
        PID:1580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\45d54a71-23cb-4fed-8936-9a112da3bbc9.vbs"
        22⤵
        
        PID:1528
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ba503d7-a8e3-4a19-baac-0ca079a4c98c.vbs"
        20⤵
        
        PID:4624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f81988d-b49e-41b1-b874-4f731a80a5d3.vbs"
        18⤵
        
        PID:5068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fe7322e-1759-4f11-b44c-03b4905290d9.vbs"
        16⤵
        
        PID:1316
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6352fae-99b0-406d-9818-e3ed5dd0352c.vbs"
        14⤵
        
        PID:4284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9f9a562-f1eb-4eb4-afd0-6cf5a4a4d599.vbs"
        12⤵
        
        PID:1776
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5b47621-328f-4d42-8619-37c1b2a45294.vbs"
        10⤵
        
        PID:392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44f99bd9-5839-46f3-9f7c-a9b3920cdf4d.vbs"
        8⤵
        
        PID:3268
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b73465bf-8194-475d-a40c-6d08ec74816d.vbs"
        6⤵
        
        PID:1272
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d705cc4-6ca8-4184-bf6f-92f86282c5ba.vbs"
      4⤵
      PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Downloaded Program Files\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\System\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Vss\Writers\System\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d17ae00f44e29422af960ea35c468610_NeikiAnalyticsd" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d17ae00f44e29422af960ea35c468610_NeikiAnalytics" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "d17ae00f44e29422af960ea35c468610_NeikiAnalyticsd" /sc MINUTE /mo 14 /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\pris\d17ae00f44e29422af960ea35c468610_NeikiAnalytics.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\it-IT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\es-ES\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\es-ES\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX8569.tmp

Path C:\Program Files\Windows Security\BrowserCore\en-US\RCX8569.tmp
Size 2.9MB
SHA256 09aeec02546ed870ca55bc5dfa7c7ca9d98b4ede5a96b4fcc6665cd79ddea8c3
MD5 b476d0db76111e295e0826daedc34c6e
SHA1 88416d1904f44b71f61d620bfaa21a7b4cad0239
SHA512 c9ae6f4e15ea17d97a7942f6882a2a98528a392f639934b0a8ee35b67cc5a1c609478c9fad984f87479fb55175982993ed647aa77ca341d139424395c21a686d
SSDEEP 49152:f4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:QDKmzjWnC8Wikx1DUN2/Uq
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
MD5 a8e8360d573a4ff072dcc6f09d992c88
SHA1 3446774433ceaf0b400073914facab11b98b6807
SHA512 4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
MD5 SHA1 SHA512

Submit Download

021e0748-c0b4-4c57-908e-bcc986803de8.vbs

Path C:\Users\Admin\AppData\Local\Temp\021e0748-c0b4-4c57-908e-bcc986803de8.vbs
Size 709B
SHA256 2d151d0cfcd2f14a52b4a6393ab27bfe0f84c50c0f4522cc71f371781b9d4c2a
MD5 d668e0a6981b4ad709502406e979637a
SHA1 ee7b7bb286946edf6f0f372fd4587c936504acc2
SHA512 e28d8f8c8f29945f71dc1d845d17c20038e2cea570f6b79d0d2c2f08b4c45c2477ffb41f95dc0e7b4c88ca65803863134933556d879f34fdd3ccaf46cd639375
MD5 SHA1 SHA512

Submit Download

445bd404-251c-4f23-a3fd-c0434fbf4f35.vbs

Path C:\Users\Admin\AppData\Local\Temp\445bd404-251c-4f23-a3fd-c0434fbf4f35.vbs
Size 709B
SHA256 fb41f75eb234eb014fdd3bf70244ebf9f49ce11979e6325eeb7af1306045f769
MD5 8e649afbde1490d866aa84b509138386
SHA1 b0e1fbce7f28339c00484ab68e12adb4dc193dbd
SHA512 99f8f1a7511ca623cddb9d7d41afc287ff9b94f77cc1d421738867e07163b2b2ecd4cc83a7b4e7b2caf37953a5040900e7d2481a682f7d7923eb91377e8474a2
MD5 SHA1 SHA512

Submit Download

5c1c7024-411e-4667-ac7f-3143b81c64a7.vbs

Path C:\Users\Admin\AppData\Local\Temp\5c1c7024-411e-4667-ac7f-3143b81c64a7.vbs
Size 709B
SHA256 a87d4c2352ee92dbb733674ec73f97640bec0326f8302ee61c455b8a8b5fa883
MD5 e49546fb91b274ca8fcd4bc212fc72cb
SHA1 3ee002b2aa699c28970427498fb28ac4d4dcb84f
SHA512 d407c2ccd8051233406ff3871650024c088caffec93231b1b559d23d2d381fe33c24cd1b222bc5f0e5dd2b12a5208c9a1eed0ec80629f15414255ad04713059d
MD5 SHA1 SHA512

Submit Download

5c7e08aa-20a1-4296-9755-9a4b093f0fec.vbs

Path C:\Users\Admin\AppData\Local\Temp\5c7e08aa-20a1-4296-9755-9a4b093f0fec.vbs
Size 709B
SHA256 34a11d5a729ce5f02f4378201fe0619913601e7e017fd7cc69264e1dd5c3bcf2
MD5 3993ee56612b5d1d00fbc4bbce258e88
SHA1 486b6a5ef1db9919a521b1e025595e3b58997907
SHA512 f7d9ad99b3adc4f608e505091f8d8016b775aae5469ded81ca2119fc2c5825665a3907aca46b3851352a06f8d1c7b8c6c0bc6300cb5ebb7cbcdd93f45eaacd05
MD5 SHA1 SHA512

Submit Download

6a491ac8-96c3-4966-85f3-c8efc81f417c.vbs

Path C:\Users\Admin\AppData\Local\Temp\6a491ac8-96c3-4966-85f3-c8efc81f417c.vbs
Size 709B
SHA256 6b16e84f530754a9f277de3a03e459f052d6ea0f080b1c19f76101bb8c7a5344
MD5 5ed6fcf959964fffef47ca3f433b18ff
SHA1 6eaf0afd43410b7d66afdee5b96191cc57b119fe
SHA512 a99fda24fab16cce1f353b120b6f0c0d4628699a2b87244c5d90b4ed530039e2bcd17c2721c3d1358376a264daf438e8e8a90297da5e652862119797a450e0e9
MD5 SHA1 SHA512

Submit Download

772a891e-4db1-41cb-b3f0-6ca4ecf952c6.vbs

Path C:\Users\Admin\AppData\Local\Temp\772a891e-4db1-41cb-b3f0-6ca4ecf952c6.vbs
Size 709B
SHA256 82eb995db18c28accece409e36d0fcf41aa69fece6d30c812b3feceef8b572ab
MD5 745a0a16de2c1580e1ba244292b9525c
SHA1 3f08843b840f793a5038418e0f8d2b167150b833
SHA512 8a0aa085e84e552b3f0c43bcb76153087bca3015ce0ef089a6b906c9846db2600e0d24d2f117c60974c5394990602fb176863cf33ff5e4c423383bc2a52eea24
MD5 SHA1 SHA512

Submit Download

7f7b8fcc-ac92-47e6-b54d-cdacbd35e79e.vbs

Path C:\Users\Admin\AppData\Local\Temp\7f7b8fcc-ac92-47e6-b54d-cdacbd35e79e.vbs
Size 709B
SHA256 9e03556d0ab9e1d725e5d406aa3bc22aa28ed7226e190a958093f138342f7a5d
MD5 a4b0ae28ce2f5baaab6cbcc2ed89e559
SHA1 47a7982b41b6e117cfe819f9a7fa349d958dfd4e
SHA512 0e63b637cfc217bee29b5dca481cb97784612fbd4f6af1de3dcf4fa3e25ae10ac130d0ed73e2ee9154913f2835bd36e691621796b332255d94a1ebf0d716a0ad
MD5 SHA1 SHA512

Submit Download

804beaa1-2191-4c08-a49d-a5a3c2e8b8c7.vbs

Path C:\Users\Admin\AppData\Local\Temp\804beaa1-2191-4c08-a49d-a5a3c2e8b8c7.vbs
Size 709B
SHA256 12f5f6c64cb523d1b0724930593cb02cd7338fb6a11d352b40fd7fa4fe73da64
MD5 99726c21d546ba31e2a9c5829c4ef563
SHA1 79bd9eff247f595bf8199182a30a554a85e48594
SHA512 6f81188fa85def3ff449fdd06f91dfad1c625ca958bb5c505900ffd65542d6d63d114b268ee2fe67b3c5d062737c56945d9e36298940f8174042e49706ad456d
MD5 SHA1 SHA512

Submit Download

8d705cc4-6ca8-4184-bf6f-92f86282c5ba.vbs

Path C:\Users\Admin\AppData\Local\Temp\8d705cc4-6ca8-4184-bf6f-92f86282c5ba.vbs
Size 485B
SHA256 5b780955e6e8e76fdfd15b338ae90cbf90d4590ea3d2f79eb763602bf40b0a0b
MD5 8c6c9134afda1807d751fb2e32fefedf
SHA1 0e5f631b7213536147fde6a8accf805bf466d4b8
SHA512 48a5c67736772ac0345f2fd9d0ccf54bcf4f8c4d0fea9f307c4b5d9f012fd90794a36b856d99d6ddd45fac7938882b637733e732d31b54e88367795eac9589b8
MD5 SHA1 SHA512

Submit Download

96e94b00-5e1b-4bbb-b850-f24cc86d92cd.vbs

Path C:\Users\Admin\AppData\Local\Temp\96e94b00-5e1b-4bbb-b850-f24cc86d92cd.vbs
Size 709B
SHA256 c3163f4a7f61853c5f4911673b90664ad13cb28600a2446294012385319768c6
MD5 6a6c14d4fef89c8c36be3ff9a393a054
SHA1 f372fcabb0cdd5a396bd402416c9ba2cb81d9fc6
SHA512 04c13859b2a1652715e258b97d185e8cb1e781fe88c65b311759cdfd9821e9127b6a8a651a95b1bc2b93db4d298eac571cd26a0d550f54457e7a2c460247c5d0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5dlokvz4.s2h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5dlokvz4.s2h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

c818e6da-4fb0-4016-b0f8-863325bd0850.vbs

Path C:\Users\Admin\AppData\Local\Temp\c818e6da-4fb0-4016-b0f8-863325bd0850.vbs
Size 709B
SHA256 5c67fe293ab29b8e0b1fc5e14efdbec0bd0cc287cb794f9a3e7cd7cb9cbcb659
MD5 ea69d5eda14074c8a1f4641a54da32be
SHA1 cb16ed5d3fc4b734a8320a8642e514bc91d99d63
SHA512 3a957456db46992e3ef3684a54e3419548c583394a92f7be92770e251f320cc4f0a2fa5ef64e8810f7a7f7905e8ca7fdca58b06e36ddf534e145f808d0b94ab8
MD5 SHA1 SHA512

Submit Download

cf81a45f-dc21-4998-a9bf-0a3b521a05d1.vbs

Path C:\Users\Admin\AppData\Local\Temp\cf81a45f-dc21-4998-a9bf-0a3b521a05d1.vbs
Size 709B
SHA256 b7921f063b833db7180a2d7435fd388744677c50f45d6cbc815f8b7441d92dc6
MD5 88a8ab0aa72917a7104845677350eb23
SHA1 f4ef59431b9e8a774eafce8f7d17f59ca8115450
SHA512 de8c2275f51f79cfde16e0289770f62bf79566e8a6b234b5c88b282cdd9d7472511af82e0acbb4cc69a6c10541d9a6d9a49f2d77f1fa6d7836601257287f6273
MD5 SHA1 SHA512

Submit Download

dbfd9b14-a782-4fa5-8235-d783e094cf43.vbs

Path C:\Users\Admin\AppData\Local\Temp\dbfd9b14-a782-4fa5-8235-d783e094cf43.vbs
Size 709B
SHA256 cb963ccf876b6d0ce9da98ba1e482496ac6caf7579dfaa3c66230f04dd9e7488
MD5 d7d0d7b57e7767bdb3f5d926b3e0914d
SHA1 40092382571a76e373853bbe07d0068ccc00a0a2
SHA512 4c50bfb6fb502ee1564bd4cbd00495b859383e33f269bb892f7001099678d78459c0220839f6135202aad426af926b72345546731def3e45ed1d4107678c95d7
MD5 SHA1 SHA512

Submit Download

f579efe7-da4c-43ce-a6d5-fb4405a8193f.vbs

Path C:\Users\Admin\AppData\Local\Temp\f579efe7-da4c-43ce-a6d5-fb4405a8193f.vbs
Size 708B
SHA256 e936781a8d2aa8276da887f6a4c98b2e495da52db693fd03b7d2dfcda7f48fb1
MD5 3dceb5de25890a285660cc14bf928dfd
SHA1 2683955e809b8dfc4c68979bd26f11af64af1675
SHA512 a299fba98eded3a63985ced8e6e240680cf9a0e4a6c89481caf233179f049fb7a0c5b6ef60d50fc62fd5b9123d3c66fb2584f0e1203c4c0a7ca6af0c0fef9199
MD5 SHA1 SHA512

Submit Download

fw4F37BOSV.bat

Path C:\Users\Admin\AppData\Local\Temp\fw4F37BOSV.bat
Size 198B
SHA256 39121206fb29f5b4cb553be548b40b0890a216eb7e37d82eebdc507c1340b68b
MD5 714063ba3045fe122c6a61af7a2c71ac
SHA1 2f3978dd501a1e009822f11ef214ac80ad760b48
SHA512 ee8ccd67ece64454fc6305d41ae975fd8ab2f922e86b14cd1e5b7257a40aaee40797316eb76f26af8a494680990c8bbb51e9066e9696603bc3f2b521f23bbe98
MD5 SHA1 SHA512

Submit Download

dllhost.exe

Path C:\Users\Default\dllhost.exe
Size 2.9MB
SHA256 69d31ec636dec62a16684f005b68b90c30cd190735dc100794610357a09186f1
MD5 37598dc34295360bc195c21e8c3bb652
SHA1 3a8b3dcda8ae13ccafdff2bee4b9be761662a2a2
SHA512 4ad48641ac66a50c0b881ccc7b8fe1de797dc9109fd3c9539d6e2a38caa777d84d9b7faa7930087b1db1218399a06fdc99df27390b3a4c62233c955ba6f43807
SSDEEP 49152:H4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:YDKmzjWnC8Wikx1DUN2/Uq
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\Vss\Writers\System\spoolsv.exe
Size 2.9MB
SHA256 0e31f2eb414aeb213e3277af70dbd34840d6232a486b3f6a4fd6526ed7f6286c
MD5 d17ae00f44e29422af960ea35c468610
SHA1 75ccfc65d62d89361564db2a01107264ba16ef5a
SHA512 905e9797d2b0b6c83f1a6e24d8af9ff928712e40651fe3ce649a38d5f40f464fbe7be0bf94ed44066509355a87e336c356cf11c3d7e1534c42202b124f07a414
SSDEEP 49152:/4DKm+cjWnC8WLqxdGWJMcWI2TJT1Q0UN2Trsljq:wDKmzjWnC8Wikx1DUN2/Uq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1136-196-0x000001776FDD0000-0x000001776FDF2000-memory.dmp

Download

memory/1204-316-0x0000000000C30000-0x0000000000F16000-memory.dmp

Download

memory/1524-452-0x000000001B680000-0x000000001B692000-memory.dmp

Download

memory/2968-16-0x000000001C250000-0x000000001C262000-memory.dmp

Download

memory/2968-12-0x000000001C200000-0x000000001C256000-memory.dmp

Download

memory/2968-18-0x000000001C280000-0x000000001C288000-memory.dmp

Download

memory/2968-27-0x000000001C300000-0x000000001C30C000-memory.dmp

Download

memory/2968-19-0x000000001C290000-0x000000001C298000-memory.dmp

Download

memory/2968-198-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/2968-20-0x000000001C2A0000-0x000000001C2AA000-memory.dmp

Download

memory/2968-21-0x000000001C2B0000-0x000000001C2BE000-memory.dmp

Download

memory/2968-23-0x000000001C2D0000-0x000000001C2DE000-memory.dmp

Download

memory/2968-22-0x000000001C2C0000-0x000000001C2C8000-memory.dmp

Download

memory/2968-17-0x000000001C7B0000-0x000000001CCD8000-memory.dmp

Download

memory/2968-15-0x000000001BB90000-0x000000001BB9C000-memory.dmp

Download

memory/2968-26-0x000000001C400000-0x000000001C40A000-memory.dmp

Download

memory/2968-24-0x000000001C2E0000-0x000000001C2EC000-memory.dmp

Download

memory/2968-0-0x00007FF9036E3000-0x00007FF9036E5000-memory.dmp

Download

memory/2968-14-0x000000001BB80000-0x000000001BB88000-memory.dmp

Download

memory/2968-10-0x000000001BA40000-0x000000001BA50000-memory.dmp

Download

memory/2968-11-0x000000001BA50000-0x000000001BA5A000-memory.dmp

Download

memory/2968-13-0x000000001BA60000-0x000000001BA6C000-memory.dmp

Download

memory/2968-1-0x0000000000BD0000-0x0000000000EB6000-memory.dmp

Download

memory/2968-9-0x000000001BA30000-0x000000001BA38000-memory.dmp

Download

memory/2968-7-0x000000001BA00000-0x000000001BA16000-memory.dmp

Download

memory/2968-25-0x000000001C2F0000-0x000000001C2F8000-memory.dmp

Download

memory/2968-8-0x000000001BA20000-0x000000001BA28000-memory.dmp

Download

memory/2968-5-0x000000001B9E0000-0x000000001B9E8000-memory.dmp

Download

memory/2968-6-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

memory/2968-4-0x000000001C1B0000-0x000000001C200000-memory.dmp

Download

memory/2968-3-0x00000000030D0000-0x00000000030EC000-memory.dmp

Download

memory/2968-2-0x00007FF9036E0000-0x00007FF9041A1000-memory.dmp

Download

memory/3620-362-0x0000000002870000-0x0000000002882000-memory.dmp

Download

memory/3732-385-0x000000001BF80000-0x000000001BF92000-memory.dmp

Download