Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe
-
Size
124KB
-
MD5
ade14dacb4f69ba39a54d046ca911290
-
SHA1
641c1573c9dc186e219f8d07eb1ebef34673b37f
-
SHA256
5aac6feeca4f7ea8a0621d8de5d6759eeb47c0953ead1f74cb4519d026058f63
-
SHA512
04c094bc66ee5151f3a035023216d5a1b8e00f39ee3a239116577075c70c35368c11319e5265bcb173e95488a1b7fc96a67e7ff578aa9d34fb6b67eb0e3b24ba
-
SSDEEP
1536:SQsz45Y9ihRO/N69BH3OoGa+FL9jKceRgrkjSo:FGKY8hkFoN3Oo1+F92S
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 42 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" laexag.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kouazuz.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" loogua.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xoehaj.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tzliiy.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xaaaxun.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" naaket.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pcdec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" weioxu.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diadoh.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tooqaat.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vebuy.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bbyow.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jocuh.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rouanay.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qides.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xyniv.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaali.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pdfuum.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raudiev.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" feeejo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" toubiec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cumud.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hnvos.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rouaso.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" geajuu.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" quroq.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" miuox.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" weaveo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raerua.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rxwuet.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meoike.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jfmiq.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuxug.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ledoz.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yoaucuc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dsfid.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeeare.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xaixi.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tpfiih.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" suihaf.exe -
Checks computer location settings 2 TTPs 42 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation raerua.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation laexag.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation bbyow.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation raudiev.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation tooqaat.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation geajuu.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation pcdec.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation rxwuet.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation toubiec.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation pdfuum.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation nuxug.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation zeeare.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation weioxu.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation jocuh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation ledoz.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation rouaso.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation qides.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation dsfid.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation diadoh.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation cumud.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation kouazuz.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation hnvos.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation yoaucuc.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation weaveo.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation suihaf.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation xoehaj.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation jfmiq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation quroq.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation kaali.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation miuox.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation xaixi.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation loogua.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation tpfiih.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation tzliiy.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation vebuy.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation xyniv.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation meoike.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation xaaaxun.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation rouanay.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation naaket.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation feeejo.exe -
Executes dropped EXE 42 IoCs
pid Process 1912 rxwuet.exe 3924 qides.exe 3948 vebuy.exe 3192 laexag.exe 4956 quroq.exe 3932 feeejo.exe 4764 xyniv.exe 768 meoike.exe 2956 pcdec.exe 872 kaali.exe 4508 toubiec.exe 440 bbyow.exe 2376 jfmiq.exe 3492 cumud.exe 4308 zeeare.exe 2380 weioxu.exe 4108 miuox.exe 4976 xaixi.exe 1908 jocuh.exe 4896 kouazuz.exe 2692 hnvos.exe 4524 pdfuum.exe 1528 loogua.exe 4000 nuxug.exe 4484 raudiev.exe 60 tpfiih.exe 4588 ledoz.exe 1844 yoaucuc.exe 1864 weaveo.exe 4876 suihaf.exe 1508 diadoh.exe 3384 xoehaj.exe 744 tzliiy.exe 1544 xaaaxun.exe 4352 rouanay.exe 2036 raerua.exe 3752 rouaso.exe 1188 naaket.exe 4324 tooqaat.exe 3584 geajuu.exe 2244 dsfid.exe 2248 zaiuha.exe -
Adds Run key to start application 2 TTPs 42 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jfmiq = "C:\\Users\\Admin\\jfmiq.exe /N" bbyow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nuxug = "C:\\Users\\Admin\\nuxug.exe /w" loogua.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weioxu = "C:\\Users\\Admin\\weioxu.exe /E" zeeare.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaixi = "C:\\Users\\Admin\\xaixi.exe /W" miuox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnvos = "C:\\Users\\Admin\\hnvos.exe /k" kouazuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qides = "C:\\Users\\Admin\\qides.exe /V" rxwuet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toubiec = "C:\\Users\\Admin\\toubiec.exe /m" kaali.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cumud = "C:\\Users\\Admin\\cumud.exe /C" jfmiq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yoaucuc = "C:\\Users\\Admin\\yoaucuc.exe /S" ledoz.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xoehaj = "C:\\Users\\Admin\\xoehaj.exe /e" diadoh.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rouaso = "C:\\Users\\Admin\\rouaso.exe /Q" raerua.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laexag = "C:\\Users\\Admin\\laexag.exe /G" vebuy.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meoike = "C:\\Users\\Admin\\meoike.exe /b" xyniv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tpfiih = "C:\\Users\\Admin\\tpfiih.exe /t" raudiev.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\miuox = "C:\\Users\\Admin\\miuox.exe /Y" weioxu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pdfuum = "C:\\Users\\Admin\\pdfuum.exe /g" hnvos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raudiev = "C:\\Users\\Admin\\raudiev.exe /I" nuxug.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\weaveo = "C:\\Users\\Admin\\weaveo.exe /e" yoaucuc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diadoh = "C:\\Users\\Admin\\diadoh.exe /C" suihaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quroq = "C:\\Users\\Admin\\quroq.exe /b" laexag.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\feeejo = "C:\\Users\\Admin\\feeejo.exe /F" quroq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaali = "C:\\Users\\Admin\\kaali.exe /p" pcdec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raerua = "C:\\Users\\Admin\\raerua.exe /a" rouanay.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeeare = "C:\\Users\\Admin\\zeeare.exe /w" cumud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\naaket = "C:\\Users\\Admin\\naaket.exe /Q" rouaso.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geajuu = "C:\\Users\\Admin\\geajuu.exe /L" tooqaat.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dsfid = "C:\\Users\\Admin\\dsfid.exe /V" geajuu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zaiuha = "C:\\Users\\Admin\\zaiuha.exe /L" dsfid.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rxwuet = "C:\\Users\\Admin\\rxwuet.exe /t" ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\suihaf = "C:\\Users\\Admin\\suihaf.exe /R" weaveo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rouanay = "C:\\Users\\Admin\\rouanay.exe /s" xaaaxun.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kouazuz = "C:\\Users\\Admin\\kouazuz.exe /x" jocuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ledoz = "C:\\Users\\Admin\\ledoz.exe /d" tpfiih.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzliiy = "C:\\Users\\Admin\\tzliiy.exe /J" xoehaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vebuy = "C:\\Users\\Admin\\vebuy.exe /g" qides.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pcdec = "C:\\Users\\Admin\\pcdec.exe /h" meoike.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jocuh = "C:\\Users\\Admin\\jocuh.exe /F" xaixi.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaaaxun = "C:\\Users\\Admin\\xaaaxun.exe /T" tzliiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tooqaat = "C:\\Users\\Admin\\tooqaat.exe /l" naaket.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xyniv = "C:\\Users\\Admin\\xyniv.exe /B" feeejo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbyow = "C:\\Users\\Admin\\bbyow.exe /p" toubiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loogua = "C:\\Users\\Admin\\loogua.exe /R" pdfuum.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4044 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 4044 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 1912 rxwuet.exe 1912 rxwuet.exe 3924 qides.exe 3924 qides.exe 3948 vebuy.exe 3948 vebuy.exe 3192 laexag.exe 3192 laexag.exe 4956 quroq.exe 4956 quroq.exe 3932 feeejo.exe 3932 feeejo.exe 4764 xyniv.exe 4764 xyniv.exe 768 meoike.exe 768 meoike.exe 2956 pcdec.exe 2956 pcdec.exe 872 kaali.exe 872 kaali.exe 4508 toubiec.exe 4508 toubiec.exe 440 bbyow.exe 440 bbyow.exe 2376 jfmiq.exe 2376 jfmiq.exe 3492 cumud.exe 3492 cumud.exe 4308 zeeare.exe 4308 zeeare.exe 2380 weioxu.exe 2380 weioxu.exe 4108 miuox.exe 4108 miuox.exe 4976 xaixi.exe 4976 xaixi.exe 1908 jocuh.exe 1908 jocuh.exe 4896 kouazuz.exe 4896 kouazuz.exe 2692 hnvos.exe 2692 hnvos.exe 4524 pdfuum.exe 4524 pdfuum.exe 1528 loogua.exe 1528 loogua.exe 4000 nuxug.exe 4000 nuxug.exe 4484 raudiev.exe 4484 raudiev.exe 60 tpfiih.exe 60 tpfiih.exe 4588 ledoz.exe 4588 ledoz.exe 1844 yoaucuc.exe 1844 yoaucuc.exe 1864 weaveo.exe 1864 weaveo.exe 4876 suihaf.exe 4876 suihaf.exe 1508 diadoh.exe 1508 diadoh.exe -
Suspicious use of SetWindowsHookEx 43 IoCs
pid Process 4044 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 1912 rxwuet.exe 3924 qides.exe 3948 vebuy.exe 3192 laexag.exe 4956 quroq.exe 3932 feeejo.exe 4764 xyniv.exe 768 meoike.exe 2956 pcdec.exe 872 kaali.exe 4508 toubiec.exe 440 bbyow.exe 2376 jfmiq.exe 3492 cumud.exe 4308 zeeare.exe 2380 weioxu.exe 4108 miuox.exe 4976 xaixi.exe 1908 jocuh.exe 4896 kouazuz.exe 2692 hnvos.exe 4524 pdfuum.exe 1528 loogua.exe 4000 nuxug.exe 4484 raudiev.exe 60 tpfiih.exe 4588 ledoz.exe 1844 yoaucuc.exe 1864 weaveo.exe 4876 suihaf.exe 1508 diadoh.exe 3384 xoehaj.exe 744 tzliiy.exe 1544 xaaaxun.exe 4352 rouanay.exe 2036 raerua.exe 3752 rouaso.exe 1188 naaket.exe 4324 tooqaat.exe 3584 geajuu.exe 2244 dsfid.exe 2248 zaiuha.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4044 wrote to memory of 1912 4044 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 90 PID 4044 wrote to memory of 1912 4044 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 90 PID 4044 wrote to memory of 1912 4044 ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe 90 PID 1912 wrote to memory of 3924 1912 rxwuet.exe 96 PID 1912 wrote to memory of 3924 1912 rxwuet.exe 96 PID 1912 wrote to memory of 3924 1912 rxwuet.exe 96 PID 3924 wrote to memory of 3948 3924 qides.exe 98 PID 3924 wrote to memory of 3948 3924 qides.exe 98 PID 3924 wrote to memory of 3948 3924 qides.exe 98 PID 3948 wrote to memory of 3192 3948 vebuy.exe 101 PID 3948 wrote to memory of 3192 3948 vebuy.exe 101 PID 3948 wrote to memory of 3192 3948 vebuy.exe 101 PID 3192 wrote to memory of 4956 3192 laexag.exe 102 PID 3192 wrote to memory of 4956 3192 laexag.exe 102 PID 3192 wrote to memory of 4956 3192 laexag.exe 102 PID 4956 wrote to memory of 3932 4956 quroq.exe 103 PID 4956 wrote to memory of 3932 4956 quroq.exe 103 PID 4956 wrote to memory of 3932 4956 quroq.exe 103 PID 3932 wrote to memory of 4764 3932 feeejo.exe 104 PID 3932 wrote to memory of 4764 3932 feeejo.exe 104 PID 3932 wrote to memory of 4764 3932 feeejo.exe 104 PID 4764 wrote to memory of 768 4764 xyniv.exe 105 PID 4764 wrote to memory of 768 4764 xyniv.exe 105 PID 4764 wrote to memory of 768 4764 xyniv.exe 105 PID 768 wrote to memory of 2956 768 meoike.exe 107 PID 768 wrote to memory of 2956 768 meoike.exe 107 PID 768 wrote to memory of 2956 768 meoike.exe 107 PID 2956 wrote to memory of 872 2956 pcdec.exe 108 PID 2956 wrote to memory of 872 2956 pcdec.exe 108 PID 2956 wrote to memory of 872 2956 pcdec.exe 108 PID 872 wrote to memory of 4508 872 kaali.exe 110 PID 872 wrote to memory of 4508 872 kaali.exe 110 PID 872 wrote to memory of 4508 872 kaali.exe 110 PID 4508 wrote to memory of 440 4508 toubiec.exe 111 PID 4508 wrote to memory of 440 4508 toubiec.exe 111 PID 4508 wrote to memory of 440 4508 toubiec.exe 111 PID 440 wrote to memory of 2376 440 bbyow.exe 112 PID 440 wrote to memory of 2376 440 bbyow.exe 112 PID 440 wrote to memory of 2376 440 bbyow.exe 112 PID 2376 wrote to memory of 3492 2376 jfmiq.exe 113 PID 2376 wrote to memory of 3492 2376 jfmiq.exe 113 PID 2376 wrote to memory of 3492 2376 jfmiq.exe 113 PID 3492 wrote to memory of 4308 3492 cumud.exe 114 PID 3492 wrote to memory of 4308 3492 cumud.exe 114 PID 3492 wrote to memory of 4308 3492 cumud.exe 114 PID 4308 wrote to memory of 2380 4308 zeeare.exe 115 PID 4308 wrote to memory of 2380 4308 zeeare.exe 115 PID 4308 wrote to memory of 2380 4308 zeeare.exe 115 PID 2380 wrote to memory of 4108 2380 weioxu.exe 116 PID 2380 wrote to memory of 4108 2380 weioxu.exe 116 PID 2380 wrote to memory of 4108 2380 weioxu.exe 116 PID 4108 wrote to memory of 4976 4108 miuox.exe 117 PID 4108 wrote to memory of 4976 4108 miuox.exe 117 PID 4108 wrote to memory of 4976 4108 miuox.exe 117 PID 4976 wrote to memory of 1908 4976 xaixi.exe 118 PID 4976 wrote to memory of 1908 4976 xaixi.exe 118 PID 4976 wrote to memory of 1908 4976 xaixi.exe 118 PID 1908 wrote to memory of 4896 1908 jocuh.exe 120 PID 1908 wrote to memory of 4896 1908 jocuh.exe 120 PID 1908 wrote to memory of 4896 1908 jocuh.exe 120 PID 4896 wrote to memory of 2692 4896 kouazuz.exe 121 PID 4896 wrote to memory of 2692 4896 kouazuz.exe 121 PID 4896 wrote to memory of 2692 4896 kouazuz.exe 121 PID 2692 wrote to memory of 4524 2692 hnvos.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ade14dacb4f69ba39a54d046ca911290_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\rxwuet.exe"C:\Users\Admin\rxwuet.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\qides.exe"C:\Users\Admin\qides.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\vebuy.exe"C:\Users\Admin\vebuy.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\laexag.exe"C:\Users\Admin\laexag.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\quroq.exe"C:\Users\Admin\quroq.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\feeejo.exe"C:\Users\Admin\feeejo.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\xyniv.exe"C:\Users\Admin\xyniv.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\meoike.exe"C:\Users\Admin\meoike.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\pcdec.exe"C:\Users\Admin\pcdec.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\kaali.exe"C:\Users\Admin\kaali.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\toubiec.exe"C:\Users\Admin\toubiec.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\bbyow.exe"C:\Users\Admin\bbyow.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\jfmiq.exe"C:\Users\Admin\jfmiq.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\cumud.exe"C:\Users\Admin\cumud.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\zeeare.exe"C:\Users\Admin\zeeare.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\weioxu.exe"C:\Users\Admin\weioxu.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\miuox.exe"C:\Users\Admin\miuox.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\xaixi.exe"C:\Users\Admin\xaixi.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\jocuh.exe"C:\Users\Admin\jocuh.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\kouazuz.exe"C:\Users\Admin\kouazuz.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\hnvos.exe"C:\Users\Admin\hnvos.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\pdfuum.exe"C:\Users\Admin\pdfuum.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4524 -
C:\Users\Admin\loogua.exe"C:\Users\Admin\loogua.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1528 -
C:\Users\Admin\nuxug.exe"C:\Users\Admin\nuxug.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4000 -
C:\Users\Admin\raudiev.exe"C:\Users\Admin\raudiev.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4484 -
C:\Users\Admin\tpfiih.exe"C:\Users\Admin\tpfiih.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:60 -
C:\Users\Admin\ledoz.exe"C:\Users\Admin\ledoz.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4588 -
C:\Users\Admin\yoaucuc.exe"C:\Users\Admin\yoaucuc.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1844 -
C:\Users\Admin\weaveo.exe"C:\Users\Admin\weaveo.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Users\Admin\suihaf.exe"C:\Users\Admin\suihaf.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4876 -
C:\Users\Admin\diadoh.exe"C:\Users\Admin\diadoh.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1508 -
C:\Users\Admin\xoehaj.exe"C:\Users\Admin\xoehaj.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3384 -
C:\Users\Admin\tzliiy.exe"C:\Users\Admin\tzliiy.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:744 -
C:\Users\Admin\xaaaxun.exe"C:\Users\Admin\xaaaxun.exe"35⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1544 -
C:\Users\Admin\rouanay.exe"C:\Users\Admin\rouanay.exe"36⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4352 -
C:\Users\Admin\raerua.exe"C:\Users\Admin\raerua.exe"37⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2036 -
C:\Users\Admin\rouaso.exe"C:\Users\Admin\rouaso.exe"38⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3752 -
C:\Users\Admin\naaket.exe"C:\Users\Admin\naaket.exe"39⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1188 -
C:\Users\Admin\tooqaat.exe"C:\Users\Admin\tooqaat.exe"40⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4324 -
C:\Users\Admin\geajuu.exe"C:\Users\Admin\geajuu.exe"41⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3584 -
C:\Users\Admin\dsfid.exe"C:\Users\Admin\dsfid.exe"42⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2244 -
C:\Users\Admin\zaiuha.exe"C:\Users\Admin\zaiuha.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5b737924b4c69c2be56bdeac4d5d28d43
SHA13f03f9678dca502531312575301249838981ca57
SHA25619337fa28ed5efa58a78348a3eb2fa707ec45b3ce91643d5c912079c1508aec6
SHA512c2d1e1c179f53321b9a3be849d25a11cec03cf6a20a68d5755f3e638b651afb5f956cf52fe81b876e7106e42593fc07118d1e397a0aed5d6d9c6ae0aceb58aa4
-
Filesize
124KB
MD5d28740b23f6e4b973927dd4fb738b694
SHA1e25fc78f06173edd63760f3dbbd42c6a7ddb6ae0
SHA25614620eda816ce5c854d65ab3f32bbe38244ca0dbfb2d06537198df5792c26595
SHA5124796da8be932a020f66f774649b4445914a406e420643fd184cfef6d6e096afe72858b3911f2e1cd50f745aea584df5acb38eff3281d25ca473455e24c149837
-
Filesize
124KB
MD508ae503b144d95ca60a7785a70b2d195
SHA18c12e8d4ed91493bdd68e9b97a25260084c22183
SHA25680f6f47c41de19cf40acce40ac0b48b724ca11e414a3a58b2f02df9128049001
SHA512ef7479374ada494c8498b6fa8144d4330a85335e2e5bf6014daa3213b2c092441a6d7b99ce70038b850e8d46873e13d9b25a0498fe984859d1768022a1a50e03
-
Filesize
124KB
MD5dfb9c48e7f809478a3ba458951b0cdb3
SHA191e364722b45f4d8bf611e869982a0c1df8e7f86
SHA25665672d951fc608200ae127e2d2249b57b1baf5799e6edcfecb0e4b6b3ba6ad35
SHA5128ca7ba2a3005b4d82254ee6f3cbae86ab58aa5193c31f3c29d59aaf8475e936fc1ef95b2d37d19f6da0f3588cab5bb3d47996fdd644fe41d47716788ab1a62ac
-
Filesize
124KB
MD5413225975f909c85a129f3bb2d3e8023
SHA161dbfeba4c2057d6d4b45b0417e23ca50eecf03d
SHA256814dc118ed2c610aa93052d6e6dd77b8fcb64d7ebbaf4894c04226ca3699fb54
SHA512240842c3177d460bc48ba8fa2340907122fd41c03aa2f2b8ab1eb7cea6104eda350cf627a9e9134c4fa55269d1660f80299491af6c8d135df978e9b89d353ee3
-
Filesize
124KB
MD58cc13bd525765391efc2534a0258aafb
SHA1d9b27730f9cc4adfa9f879e2ca733fe8a8bf7339
SHA25637052c235b4f49c232b60c6c6a61db0ea4e9f6dc410803ab83e01358e14a2070
SHA5124a801b6965c88f88639dcc507547e9d855dc371478264c7889f02cf117c6f8555499bf78049dc837d18ed7723cda97ed8c66fe2b04878c2bf11ffe6e9c16ea24
-
Filesize
124KB
MD5dd8bee21d2634f64af3c83499c7949c0
SHA14830e7b399baa41f80603b05c025b8a9c41ecb42
SHA2566ae6ddcdcad288ce5ef20d0495c6acc3139f4fea172335e4961d284835a8f69a
SHA512c844e15535d85e4cf9b3bd81e103041f684c7bb3c050cf5c70b7e9c45b684dcd4500586b8d642a6f0092f817d888e1173160b23de9785bd92a33086e01598638
-
Filesize
124KB
MD56f2f3689f6bf2a280c4df5edbaea9363
SHA197278193cae6a8cffee60b9d0dead66724866e51
SHA256b2eb6d9c6175cdbc9b6d9c22f7566bca8cce66953e5d2597f504be1d4d85384b
SHA51259a09d55162e7047e3ffa855fff98f1d19eed4a2efb1109fe1ac0a3ba553ec0b8b937b5ff3c08faed6584b0addb3af3db8ac1a7306d8e4abb90463647cf86118
-
Filesize
124KB
MD5e13763905adc49a77cdd405f319bef81
SHA11e64ece83c0f7018bab71cbde8e2d85dae88d5c8
SHA256587f61a6aac428a7eefa494dfe47ff5f9518d55958f4ab3c3ad21cc107aef3f7
SHA5125dd8e0d9b283f6021d6b02a47d1febfb062998f372ee79b12f38b52a62d75059b9ead27af1d39b6690420e6974988d34c3949ec416b3303b5b59a65f63417171
-
Filesize
124KB
MD5a080fedf618093ff624807871fe445a7
SHA1ed822e1abdcfa1c3c51171b116ce3b38e8d8de80
SHA2563259b17116ddffabd9b70bf52ec5d59482db52a81ea5f7138933d4926f22ea24
SHA5126c328c0a770f8204e5768e8b77dca49c8a8a510e7999b66b191db444bbb008ab9e0f857f973ac275afcde4439000d4efe859d0138d8b93bf155ccd4bc109a44e
-
Filesize
124KB
MD5b081f399ddb117afc1ee76919bcdcec6
SHA1d616513b691ad57bfa0965857f2549f12f23ab38
SHA25654dba3702c88c97d4484194c9a9a20dc75c9de291104264cae625adebd5f361e
SHA512769174e4f3c244e7994014ad1f35fd801dff3077b1b3f9021665ba284aba8c9b4632d8f60b274bae166bd57e71ee8d11a0d4f751329b5eaeb136139ff99d1b97
-
Filesize
124KB
MD59d51bf70e30921479fa4d2147e42ec47
SHA1a4ed10b885305001576a15a5f1ea7ec23e0f7c90
SHA256f055335dca4601f892727d3c6824c36bec796e2ea90d7d15f6c8aee630e13118
SHA5120ff387d829381860bafbbfce7bee0662e9347ad752e94f21a81e7329cfddae8c10ade45ac22601b55d31766bcea3908ea82bc10d943c62c2e4d026fb19c619ba
-
Filesize
124KB
MD5339d51ff95173ea3224d0cca62f6cc39
SHA16ac65f68e99517be9ee82207650359c8170ca8d5
SHA256f28c1d979a2298aaf502088a42b6a9a5a4188cf705246bc7dcde3573971dad61
SHA51288934d380f742716b149f3ce5aa9929798724bdf8515fe72442a6b18d784e2f67389166a68e05fc6d262e039f26b13e62a583397fd49ce5c6cf4be595ce79d91
-
Filesize
124KB
MD5bfe51104e69e7db9baf9efe8db8a0f12
SHA1a2d9e27c1a60e3b79bf2d96fe1d86cad99651f04
SHA2561ac84200523e8f5d241d8113a81e646ec943063230689aecec849ecec7fc048c
SHA512eda0f1a7db3af867661ab165a48311ee2ddf45cb4d823629b8f461542149cf031364e01a5bc0b66b54924e139ea792e185c6d1d1680d3827c4027104cd333456
-
Filesize
124KB
MD57187c3d1c4202c63dff9f1b9a0c1a10c
SHA13af915d23cff7e2e18fb91fa681377fa05aa0800
SHA256e0e24a9bd07bf2e9651d4893f706fe0c764ecd81e82a453d8ca2f7251549890b
SHA5122c22c1712a9cb3e49969221f37b13ed0fd66ccc31f2c197bdb77c2ffa375921cb18444a823aa7b30d18bee94a2a2c8863b6943791d5bae4f8c1ff8996f40a991
-
Filesize
124KB
MD57eb8aef478bd9cdcafc469eecb2040df
SHA163688c72b7d61292c90555d93892c604c0746381
SHA25604ca8fd6ac6b5386f8f1078470e631a2a302e4a9e0d2d009a21df5a108614b05
SHA512561309ecf9779ccdb2d17da9e3589952b63449268d649dc2771eaa70c2ee4a68efc9804b98391df431df4ed653f7ee823a88166220a5be9065d268b05e4107ed
-
Filesize
124KB
MD5acdf70855acbc454ac6f0afd6504d189
SHA12a36d5ebe440ca9b273cd9a21fd610d934f3bd59
SHA2565c87d1f1de5ad74b427cfef3112bbb4152d22f9cc986de2ccaa96055cd9d1eac
SHA5123d3f94a5037c9b2fc85a04a54ec055dd345a2a23733d0fe1ef9906eee2cbe2c3dc7c7a7b799c90755f0e9b159249792372358034c977c9ed04c12fdfe1c11645
-
Filesize
124KB
MD58e90c374f60f175bd053921481987d68
SHA1d997be036402a6e92f50662db0b77792862c124f
SHA25604a6c40ddf31b52add669ee82ff2397277c7abef1e08a0be10cb72eb1ccbf40a
SHA512b333d73fa614ad6718bab635ac9cdb2ab6a791614ac98bf4a9c7197fe65ddc5619396cb0507a7daaba1dc374735edd2fcefcb2a216203edeb908a8e59ce464cd
-
Filesize
124KB
MD5051086694562b4a84049ec7a560e02f3
SHA1a82f2ff161ba5c6b9f6df02e74c25dfc8b13a7c5
SHA256d76534c5efcc6c8d2459ef1a8198a44a6ed17e5493409126d4cf010f239c7d77
SHA51299f076a4540f89f23fdcc7aa8c59a08f84fb751402e45d4731fc2fc3851b1cd1d8673100acd21daf4ac7eab32c8eac960cd396fc23dc23e5cf2afb0ff7a78ffa
-
Filesize
124KB
MD5d809770f41574e836aa73543357a3766
SHA163501d6ec389e9f7edbabfe0eed02494fedbe8d3
SHA256f5cf7feb9b76bad91a99db86c55f35fa3e0fc0a1c21063278ce776dacb9a9915
SHA512cce238eedb64a8a357b4c6ccb437bfadd0af15dc2f18a0881401dd94972111a9fd81dac15601db2a08cc3a1ee821f9f6d8df4477a5a73d1ebaf72c4df98dc09a
-
Filesize
124KB
MD551f9f1c187cda799e1838bd0460f4926
SHA163e314ac2eec2bb4bff34bf43702951bf62f0050
SHA25615fbf0e6b0020f89b14eab9451c78a9021d85a357339878eb0c6aa9f8d0dcb84
SHA512b4bd5e8500104bd588ee7497cb4ab2a9d1e40ebdac6a63470348cfeee9821d0d12446e03d7e9f83ace40c0773f3125ac9db41bd3a8b70a0ce1dfef3b4a322992
-
Filesize
124KB
MD5720466ec89a34a227fad3c258cf3692d
SHA174f514949a1613339d365566efe2ec72e6b18ba5
SHA256539de37793e63b53149046d84cd27cb524a7c6de1e3c755253af923766d47c24
SHA512334558cea86d3d9f98a09ce73cdfe586c0ed217c90c74cabd9288b92239fefb857b376c6530101edb06864e2fbaf05d1a2b93a7140cbcbc0049d88e31d679e0e
-
Filesize
124KB
MD52eb82a8ad610d800264692221d97459d
SHA162bdb483f580681603fba6e262a1b0916aed1fa4
SHA256fd2b157a4802ff09d992ced3e4a50262f0fef3250194b0f1973db88c928c4e0d
SHA512535df7e80e387defce3ecb2037a319375da6ae2182fb4323c6c075f51a0d1dc25bb5d9d67a44d6655977f5b14c80dc02b5d4ac6c49f47b736de958438460d373
-
Filesize
124KB
MD52d108059048c8a08c3ff4362143d80d3
SHA1d850081771f691eba20767c81d52dd28af8c09a2
SHA2564f0b53878578d63192cb673f4f414486b9684a3d8103ae56980d4c2498877621
SHA5121115e5e46c110f3c8eb2d70182d60ee68979d0c3420fd0f21ca8ff615f705bdb75a65ef73e9797f1d98765d59d20fa2a6459f37c171f3c3373113fb5baf95ea8
-
Filesize
124KB
MD54eae37a6698379379d844407af315c7e
SHA137a1a4013c0675246ec51da6c58426b8d62daf2e
SHA2560c3cc5fa9bc2e9ac171df41977016e8191e0e654443fe0d8af8a630ac9384a66
SHA5124b7caeee9f0f931e11706de4457ebdce4c9a2af9b0e8599d0a0ef774b18af89f34569e1f8929caace1350518a801f758e94ab118b0457fcf862305d8bea2f658
-
Filesize
124KB
MD560335089f476f76f2b7e9552dbf4f44e
SHA13d3032d92dae79d297798c526486e4c31b6241dd
SHA2565d8a225d1580bcca8fe8ff69ec1fb8a67a21a032835f29a0386b3d0a765b772a
SHA512136c83bf58626548bf488dbe837d05f915a28ed8aa43656eb8bc1c5a758d903f758fed657ce86505a1d6e95fdb8f901331fcb525d468baa047076426b88a9f32
-
Filesize
124KB
MD5b44325802c5b38331ebcefc00b0c3fb3
SHA1cf98c3746aa070a25f0a886d87a294730b160e65
SHA256a09c811c20e775d764b295ea69e909d34142183ea9c982692fe39851dd6e6c32
SHA512ab60f52c68b8f1860fc0c4fce5c52ff0687971d1eadbd8c977e58032414333613648b757eb9795ba7a5a126cd0cf2df6235c3a56ed9e4f37ebf48ce2bea744fa
-
Filesize
124KB
MD503f7de6ef3be34d04efc935ef5ec6089
SHA12c3cd5d391aba97a705508e8ac3b735d46478732
SHA256689c7728b63dab3ea9a3920d3020d35e89f822354f9e4dae49f105b1d7df8651
SHA512b170229fd396796ac3bc12ef62fdb8fbf7b4fd56013c44a28c0dbbf6ba2e3f9698388dd4acac8284112af105b000cf8e3689b74413b2c36c18debf7473a4827d
-
Filesize
124KB
MD54f91cb6e366123b7b408b172c426d1f9
SHA111ddb16d5a2f5dabb73544346d85f044d5319038
SHA256af3d49588da8e542caa0fc5bae9df8bd48300ee95c152c134e5db87c0156b64d
SHA5127094f03433dcede40abeb0aa7a983ba9ec81a91f0e6f4e4f9139cca42c4b93ed2fe31b26f3770456aa1d70b4959d42569d574e892b8e4ecace3cd6af1795bfa4
-
Filesize
124KB
MD50d27751b0a52302ca87341e4f16f9424
SHA14155c7b75ac5ef00ebcfc651e8d39008fa7397b5
SHA256ec06aef9b4a4068185b512a4e19b3b609b36425c29c56d7194ecae1c17a70211
SHA512944628474ffd30ea4a6f4f4344f06ce7c8ee169502b0c23c5f1460456656a6f2b27e6d62594d416f64b05bc956898b1c8d5e6c2e03a9b07119a211384e9cd52a
-
Filesize
124KB
MD5bfb46d62f6be16f950aca6a81f382830
SHA1d665b7e17a6510b8dcb8f836ccef2f4eb767330f
SHA256a71ed13e369b9b14c3cf2d1489a40b305a06e0e9022158d7358cec1f0183b80d
SHA51203365be10a4a903904e85741f07e6f2c1c0507b25b9e99d544c66e21d359275fd4dc3ffa863b98ce93312c1f7e04323f3b3804a6aa996663e62c938e76f549ed
-
Filesize
124KB
MD5cdc9f9fe94fd80e90eb8ce13ea0c0d0a
SHA16cb33bd64a75a6e1ab3ef1c6c56f24683fea5336
SHA25651332af2aa1cbe0fa6b83e0ddf7b3b92acee69670b146e94406b18bd25ed7e2c
SHA5127ce2d157d2ae8b14847eec151f2be5eef27eccb3e2db41dcad24c72e16a7722c33ac95465dd518890e191064b01d1d84e6b3ef91e7ffd6663c4ffef87202c97d