Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:09
Behavioral task
behavioral1
Sample
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe
-
Size
2.2MB
-
MD5
5dd4ffa4547ffc7807bd678b06509dc6
-
SHA1
ee042b17abfca7909032601b221217728162ae9e
-
SHA256
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106
-
SHA512
e9f844418d556ca59c2b37af9ed69c7b8a8639ea51763bce3bca28d557cd6956b8c13927651635b8980af1775a424dbd284bd9cb0b429fc2f2f55ae46c770993
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZT:0UzeyQMS4DqodCnoe+iitjWwwv
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exepid process 5064 explorer.exe 3092 explorer.exe 1960 spoolsv.exe 3532 spoolsv.exe 4056 spoolsv.exe 3264 spoolsv.exe 2288 spoolsv.exe 4144 spoolsv.exe 4320 spoolsv.exe 2084 spoolsv.exe 4464 spoolsv.exe 4072 spoolsv.exe 4364 spoolsv.exe 4640 spoolsv.exe 3636 spoolsv.exe 4668 spoolsv.exe 2528 spoolsv.exe 4952 spoolsv.exe 4876 spoolsv.exe 4092 spoolsv.exe 692 spoolsv.exe 2372 spoolsv.exe 432 spoolsv.exe 1020 spoolsv.exe 3068 spoolsv.exe 2176 spoolsv.exe 1504 spoolsv.exe 2320 spoolsv.exe 3912 spoolsv.exe 4836 spoolsv.exe 4820 spoolsv.exe 2716 spoolsv.exe 2444 spoolsv.exe 3332 spoolsv.exe 2300 spoolsv.exe 3940 spoolsv.exe 1412 spoolsv.exe 4568 spoolsv.exe 2388 spoolsv.exe 5184 spoolsv.exe 5488 spoolsv.exe 5688 spoolsv.exe 5968 spoolsv.exe 2608 spoolsv.exe 5476 spoolsv.exe 5788 spoolsv.exe 5128 spoolsv.exe 5540 spoolsv.exe 5616 spoolsv.exe 5664 explorer.exe 5744 spoolsv.exe 5852 spoolsv.exe 5956 spoolsv.exe 5276 spoolsv.exe 2276 spoolsv.exe 5464 explorer.exe 6128 spoolsv.exe 4844 spoolsv.exe 5436 spoolsv.exe 5288 spoolsv.exe 5396 spoolsv.exe 5824 spoolsv.exe 6060 spoolsv.exe 6116 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 2444 set thread context of 2256 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe PID 5064 set thread context of 3092 5064 explorer.exe explorer.exe PID 1960 set thread context of 5616 1960 spoolsv.exe spoolsv.exe PID 3532 set thread context of 5744 3532 spoolsv.exe spoolsv.exe PID 4056 set thread context of 5852 4056 spoolsv.exe spoolsv.exe PID 3264 set thread context of 5956 3264 spoolsv.exe spoolsv.exe PID 2288 set thread context of 2276 2288 spoolsv.exe spoolsv.exe PID 4144 set thread context of 4844 4144 spoolsv.exe spoolsv.exe PID 4320 set thread context of 5436 4320 spoolsv.exe spoolsv.exe PID 2084 set thread context of 5288 2084 spoolsv.exe spoolsv.exe PID 4464 set thread context of 5396 4464 spoolsv.exe spoolsv.exe PID 4072 set thread context of 5824 4072 spoolsv.exe spoolsv.exe PID 4364 set thread context of 6060 4364 spoolsv.exe spoolsv.exe PID 4640 set thread context of 372 4640 spoolsv.exe spoolsv.exe PID 3636 set thread context of 5416 3636 spoolsv.exe spoolsv.exe PID 4668 set thread context of 2932 4668 spoolsv.exe spoolsv.exe PID 2528 set thread context of 1784 2528 spoolsv.exe spoolsv.exe PID 4952 set thread context of 5708 4952 spoolsv.exe spoolsv.exe PID 4876 set thread context of 4904 4876 spoolsv.exe spoolsv.exe PID 4092 set thread context of 5876 4092 spoolsv.exe spoolsv.exe PID 692 set thread context of 3380 692 spoolsv.exe spoolsv.exe PID 2372 set thread context of 5204 2372 spoolsv.exe spoolsv.exe PID 432 set thread context of 2588 432 spoolsv.exe spoolsv.exe PID 1020 set thread context of 4104 1020 spoolsv.exe spoolsv.exe PID 3068 set thread context of 1244 3068 spoolsv.exe spoolsv.exe PID 2176 set thread context of 1324 2176 spoolsv.exe spoolsv.exe PID 1504 set thread context of 4788 1504 spoolsv.exe spoolsv.exe PID 2320 set thread context of 3492 2320 spoolsv.exe spoolsv.exe PID 3912 set thread context of 1812 3912 spoolsv.exe spoolsv.exe PID 4836 set thread context of 4472 4836 spoolsv.exe spoolsv.exe PID 4820 set thread context of 5252 4820 spoolsv.exe spoolsv.exe PID 2716 set thread context of 4848 2716 spoolsv.exe spoolsv.exe PID 2444 set thread context of 3148 2444 spoolsv.exe spoolsv.exe PID 2300 set thread context of 1312 2300 spoolsv.exe spoolsv.exe PID 3940 set thread context of 3476 3940 spoolsv.exe spoolsv.exe PID 3332 set thread context of 1484 3332 spoolsv.exe spoolsv.exe PID 1412 set thread context of 5424 1412 spoolsv.exe spoolsv.exe PID 2388 set thread context of 5360 2388 spoolsv.exe spoolsv.exe PID 4568 set thread context of 4572 4568 spoolsv.exe spoolsv.exe PID 5184 set thread context of 5148 5184 spoolsv.exe spoolsv.exe PID 5488 set thread context of 5588 5488 spoolsv.exe spoolsv.exe PID 5968 set thread context of 1000 5968 spoolsv.exe spoolsv.exe PID 5688 set thread context of 5660 5688 spoolsv.exe spoolsv.exe PID 2608 set thread context of 3948 2608 spoolsv.exe spoolsv.exe PID 5788 set thread context of 4068 5788 spoolsv.exe spoolsv.exe PID 5476 set thread context of 1596 5476 spoolsv.exe spoolsv.exe PID 5128 set thread context of 4536 5128 spoolsv.exe spoolsv.exe PID 5540 set thread context of 6024 5540 spoolsv.exe spoolsv.exe PID 5664 set thread context of 5984 5664 explorer.exe explorer.exe PID 5276 set thread context of 2476 5276 spoolsv.exe spoolsv.exe PID 5464 set thread context of 6064 5464 explorer.exe explorer.exe PID 6128 set thread context of 116 6128 spoolsv.exe spoolsv.exe PID 6116 set thread context of 5868 6116 explorer.exe explorer.exe PID 5340 set thread context of 5904 5340 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exeexplorer.exepid process 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 3092 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 3092 explorer.exe 5616 spoolsv.exe 5616 spoolsv.exe 5744 spoolsv.exe 5744 spoolsv.exe 5852 spoolsv.exe 5852 spoolsv.exe 5956 spoolsv.exe 5956 spoolsv.exe 2276 spoolsv.exe 2276 spoolsv.exe 4844 spoolsv.exe 4844 spoolsv.exe 5436 spoolsv.exe 5436 spoolsv.exe 5288 spoolsv.exe 5288 spoolsv.exe 5396 spoolsv.exe 5396 spoolsv.exe 5824 spoolsv.exe 5824 spoolsv.exe 6060 spoolsv.exe 6060 spoolsv.exe 372 spoolsv.exe 372 spoolsv.exe 5416 spoolsv.exe 5416 spoolsv.exe 2932 spoolsv.exe 2932 spoolsv.exe 1784 spoolsv.exe 1784 spoolsv.exe 5708 spoolsv.exe 5708 spoolsv.exe 4904 spoolsv.exe 4904 spoolsv.exe 5876 spoolsv.exe 5876 spoolsv.exe 3380 spoolsv.exe 3380 spoolsv.exe 5204 spoolsv.exe 5204 spoolsv.exe 2588 spoolsv.exe 2588 spoolsv.exe 4104 spoolsv.exe 4104 spoolsv.exe 1244 spoolsv.exe 1244 spoolsv.exe 1324 spoolsv.exe 1324 spoolsv.exe 4788 spoolsv.exe 4788 spoolsv.exe 3492 spoolsv.exe 3492 spoolsv.exe 1812 spoolsv.exe 1812 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 5252 spoolsv.exe 5252 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exeexplorer.exeexplorer.exedescription pid process target process PID 2444 wrote to memory of 3168 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe splwow64.exe PID 2444 wrote to memory of 3168 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe splwow64.exe PID 2444 wrote to memory of 2256 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe PID 2444 wrote to memory of 2256 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe PID 2444 wrote to memory of 2256 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe PID 2444 wrote to memory of 2256 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe PID 2444 wrote to memory of 2256 2444 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe PID 2256 wrote to memory of 5064 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe explorer.exe PID 2256 wrote to memory of 5064 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe explorer.exe PID 2256 wrote to memory of 5064 2256 471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe explorer.exe PID 5064 wrote to memory of 3092 5064 explorer.exe explorer.exe PID 5064 wrote to memory of 3092 5064 explorer.exe explorer.exe PID 5064 wrote to memory of 3092 5064 explorer.exe explorer.exe PID 5064 wrote to memory of 3092 5064 explorer.exe explorer.exe PID 5064 wrote to memory of 3092 5064 explorer.exe explorer.exe PID 3092 wrote to memory of 1960 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 1960 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 1960 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3532 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3532 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3532 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4056 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4056 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4056 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3264 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3264 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3264 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2288 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2288 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2288 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4144 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4144 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4144 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4320 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4320 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4320 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2084 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2084 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2084 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4464 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4464 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4464 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4072 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4072 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4072 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4364 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4364 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4364 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4640 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4640 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4640 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3636 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3636 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 3636 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4668 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4668 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4668 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2528 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2528 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 2528 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4952 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4952 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4952 3092 explorer.exe spoolsv.exe PID 3092 wrote to memory of 4876 3092 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\471035bceeb4b9ae334c36d3201294a3d68b773d8a748c91eb439575fdb3d106_NeikiAnalytics.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD52226396fe191f9156aa1c36b09f17b05
SHA131c1cd32aa818e9da7902adb7319e0fdb6d65d5b
SHA256c30728baef7a79583c43a7b102d2a6aef17b41cf884c00321537e268733c6500
SHA5126c1292bfa487505943552c161b95dfe01e4b5e6d8d3b5fe572bde4a44f0d4fcca92795cee029d673fe96e416a18cacb37b8fd4ab6242b94a40a5058959a035ba
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD5b9ee3fe1e9fa43e16afa76bd87ce5186
SHA14c69c37c522f0b76810182db59a0e4cbe556715e
SHA2567af754d45cdfdd8eaf6d287faa08cb742ab7c98786847162942ec6d592192012
SHA512b9d804f8279098f4310d8021237b903b51ff15a7417626d8c45466efc23d8ed22873e0b6f3f6d4e89661ebb25a442f01d243b84ccf36f2c1823fed491590ade7
-
memory/116-3916-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/372-3284-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/432-2797-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/448-5672-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/692-2795-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1020-2879-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1244-3614-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1324-3627-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1504-2891-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1596-3829-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1784-3382-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1960-2883-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1960-968-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2084-1355-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2176-2890-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2256-44-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2256-46-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2256-82-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2276-3065-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2276-3228-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2288-1182-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2320-2901-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2372-2796-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2444-47-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2444-43-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/2444-41-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2444-0-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/2528-2499-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2588-3524-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2932-3370-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3068-2881-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3092-967-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3092-98-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3148-3719-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3264-1181-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3532-2894-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3532-969-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3636-2081-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3948-3806-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4056-970-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4056-2904-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4072-1687-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4092-2794-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4104-3602-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4144-1353-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4320-1354-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4360-5701-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4364-1688-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4464-1686-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4472-3688-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4536-3839-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4572-3770-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4640-2080-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4668-2082-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4688-5681-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4788-3646-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4844-3142-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4848-3708-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4876-2501-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4904-3406-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4952-2500-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5064-99-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5064-93-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/5204-3511-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5204-3681-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5252-3696-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5288-3163-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5360-3760-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5396-3173-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5416-3358-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5424-3759-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5436-3152-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5588-3785-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5616-3031-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5616-2882-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5660-3807-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5708-3392-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5744-2892-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5852-2902-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5852-2903-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/5868-4422-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5868-4425-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5876-3418-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5900-5692-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5904-4757-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5904-4850-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5984-3862-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6024-3845-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6060-3482-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6060-3273-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/6064-3873-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB