Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
013e8af05ff942cf822c24ffc11229d0_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
013e8af05ff942cf822c24ffc11229d0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
013e8af05ff942cf822c24ffc11229d0
-
SHA1
384479fd0ab11b82b03450498b21142c0b98c696
-
SHA256
5064ab54377bb937db85c525d59277900a43f7153ec3fb5492fc7b36af62325d
-
SHA512
a69810b3309fd2b6516f5e5a269fd3c475ebca2ddb4b68920b41418beee465ff97474ecca64ac47e6ffd45e95c5ca0119e19b594237e5a9da4d2661813365859
-
SSDEEP
3072:XDfFtDvBd+T3rMvIVw0IJSJcS0X3F/hPK8Ht03/Lya6:XDfFV+L4vt0sSJenFtKot03/LT6
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e5741eb.exee575db0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575db0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575db0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5741eb.exe -
Processes:
e5741eb.exee575db0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575db0.exe -
Processes:
e575db0.exee5741eb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5741eb.exe -
Executes dropped EXE 4 IoCs
Processes:
e5741eb.exee5742c6.exee575db0.exee575dc0.exepid process 1168 e5741eb.exe 4636 e5742c6.exe 4784 e575db0.exe 1464 e575dc0.exe -
Processes:
resource yara_rule behavioral2/memory/1168-6-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-31-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-27-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-13-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-32-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-12-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-10-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-9-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-14-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-11-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-8-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-37-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-38-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-39-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-40-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-41-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-43-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-44-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-58-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-60-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-61-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-75-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-77-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-80-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-82-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-83-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-84-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-86-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-88-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-90-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-91-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-101-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/1168-99-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/4784-153-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4784-144-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e5741eb.exee575db0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575db0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575db0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575db0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575db0.exe -
Processes:
e5741eb.exee575db0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575db0.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5741eb.exedescription ioc process File opened (read-only) \??\J: e5741eb.exe File opened (read-only) \??\P: e5741eb.exe File opened (read-only) \??\R: e5741eb.exe File opened (read-only) \??\T: e5741eb.exe File opened (read-only) \??\H: e5741eb.exe File opened (read-only) \??\I: e5741eb.exe File opened (read-only) \??\Q: e5741eb.exe File opened (read-only) \??\E: e5741eb.exe File opened (read-only) \??\K: e5741eb.exe File opened (read-only) \??\O: e5741eb.exe File opened (read-only) \??\S: e5741eb.exe File opened (read-only) \??\M: e5741eb.exe File opened (read-only) \??\N: e5741eb.exe File opened (read-only) \??\G: e5741eb.exe File opened (read-only) \??\L: e5741eb.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e5741eb.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e5741eb.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5741eb.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5741eb.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5741eb.exe -
Drops file in Windows directory 3 IoCs
Processes:
e5741eb.exee575db0.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI e5741eb.exe File created C:\Windows\e57ac1e e575db0.exe File created C:\Windows\e57421a e5741eb.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e5741eb.exepid process 1168 e5741eb.exe 1168 e5741eb.exe 1168 e5741eb.exe 1168 e5741eb.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e5741eb.exedescription pid process Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe Token: SeDebugPrivilege 1168 e5741eb.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
rundll32.exerundll32.exee5741eb.exedescription pid process target process PID 3328 wrote to memory of 4780 3328 rundll32.exe rundll32.exe PID 3328 wrote to memory of 4780 3328 rundll32.exe rundll32.exe PID 3328 wrote to memory of 4780 3328 rundll32.exe rundll32.exe PID 4780 wrote to memory of 1168 4780 rundll32.exe e5741eb.exe PID 4780 wrote to memory of 1168 4780 rundll32.exe e5741eb.exe PID 4780 wrote to memory of 1168 4780 rundll32.exe e5741eb.exe PID 1168 wrote to memory of 784 1168 e5741eb.exe fontdrvhost.exe PID 1168 wrote to memory of 792 1168 e5741eb.exe fontdrvhost.exe PID 1168 wrote to memory of 60 1168 e5741eb.exe dwm.exe PID 1168 wrote to memory of 2628 1168 e5741eb.exe sihost.exe PID 1168 wrote to memory of 2640 1168 e5741eb.exe svchost.exe PID 1168 wrote to memory of 2940 1168 e5741eb.exe taskhostw.exe PID 1168 wrote to memory of 3428 1168 e5741eb.exe Explorer.EXE PID 1168 wrote to memory of 3544 1168 e5741eb.exe svchost.exe PID 1168 wrote to memory of 3724 1168 e5741eb.exe DllHost.exe PID 1168 wrote to memory of 3816 1168 e5741eb.exe StartMenuExperienceHost.exe PID 1168 wrote to memory of 3884 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 3964 1168 e5741eb.exe SearchApp.exe PID 1168 wrote to memory of 3756 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 4384 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 3924 1168 e5741eb.exe TextInputHost.exe PID 1168 wrote to memory of 5092 1168 e5741eb.exe backgroundTaskHost.exe PID 1168 wrote to memory of 4200 1168 e5741eb.exe backgroundTaskHost.exe PID 1168 wrote to memory of 3328 1168 e5741eb.exe rundll32.exe PID 1168 wrote to memory of 4780 1168 e5741eb.exe rundll32.exe PID 1168 wrote to memory of 4780 1168 e5741eb.exe rundll32.exe PID 4780 wrote to memory of 4636 4780 rundll32.exe e5742c6.exe PID 4780 wrote to memory of 4636 4780 rundll32.exe e5742c6.exe PID 4780 wrote to memory of 4636 4780 rundll32.exe e5742c6.exe PID 4780 wrote to memory of 4784 4780 rundll32.exe e575db0.exe PID 4780 wrote to memory of 4784 4780 rundll32.exe e575db0.exe PID 4780 wrote to memory of 4784 4780 rundll32.exe e575db0.exe PID 4780 wrote to memory of 1464 4780 rundll32.exe e575dc0.exe PID 4780 wrote to memory of 1464 4780 rundll32.exe e575dc0.exe PID 4780 wrote to memory of 1464 4780 rundll32.exe e575dc0.exe PID 1168 wrote to memory of 784 1168 e5741eb.exe fontdrvhost.exe PID 1168 wrote to memory of 792 1168 e5741eb.exe fontdrvhost.exe PID 1168 wrote to memory of 60 1168 e5741eb.exe dwm.exe PID 1168 wrote to memory of 2628 1168 e5741eb.exe sihost.exe PID 1168 wrote to memory of 2640 1168 e5741eb.exe svchost.exe PID 1168 wrote to memory of 2940 1168 e5741eb.exe taskhostw.exe PID 1168 wrote to memory of 3428 1168 e5741eb.exe Explorer.EXE PID 1168 wrote to memory of 3544 1168 e5741eb.exe svchost.exe PID 1168 wrote to memory of 3724 1168 e5741eb.exe DllHost.exe PID 1168 wrote to memory of 3816 1168 e5741eb.exe StartMenuExperienceHost.exe PID 1168 wrote to memory of 3884 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 3964 1168 e5741eb.exe SearchApp.exe PID 1168 wrote to memory of 3756 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 4384 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 3924 1168 e5741eb.exe TextInputHost.exe PID 1168 wrote to memory of 5092 1168 e5741eb.exe backgroundTaskHost.exe PID 1168 wrote to memory of 4636 1168 e5741eb.exe e5742c6.exe PID 1168 wrote to memory of 4636 1168 e5741eb.exe e5742c6.exe PID 1168 wrote to memory of 2656 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 3248 1168 e5741eb.exe RuntimeBroker.exe PID 1168 wrote to memory of 4784 1168 e5741eb.exe e575db0.exe PID 1168 wrote to memory of 4784 1168 e5741eb.exe e575db0.exe PID 1168 wrote to memory of 1464 1168 e5741eb.exe e575dc0.exe PID 1168 wrote to memory of 1464 1168 e5741eb.exe e575dc0.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e5741eb.exee575db0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5741eb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575db0.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\013e8af05ff942cf822c24ffc11229d0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\013e8af05ff942cf822c24ffc11229d0_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5741eb.exeC:\Users\Admin\AppData\Local\Temp\e5741eb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e5742c6.exeC:\Users\Admin\AppData\Local\Temp\e5742c6.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e575db0.exeC:\Users\Admin\AppData\Local\Temp\e575db0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e575dc0.exeC:\Users\Admin\AppData\Local\Temp\e575dc0.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e5741eb.exeFilesize
97KB
MD51d2dab2e64bc5b92983812b94c5c2179
SHA1ec6e9906d9aa81ff5c3b6a11f547e9a99430ddf7
SHA256f239d8d0d93d1bef178ffa5aab72905a307c1e0f77ad27cdb75a327178a77c73
SHA512ae43ba234720a1510d8772a7139ca904762bd39ba9a9bb6dea83442682aa91b580ed6ebcb15c76a76702fa0a1c0d87e38f49324e6d1f538f6e2d426ff28ca598
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5e45ba260d9b24ee150569142a333b783
SHA1f58dab80edc86bec651694878e01f4dd39f58403
SHA256ab7d496b5795e2d7ff4c323d0592c97f02a22db5a00c5851134df41513e30537
SHA5128771575c78fd83d35f4524b1ce70d0c6d187546168765e1564004a8f87f95d9bbe9c9c0a4270e49450ddc30d4896581b0dc30653f803755eb0849467236f68e9
-
memory/1168-80-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-38-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-61-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-83-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-31-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1168-27-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-60-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-32-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-35-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1168-12-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-10-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-9-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-23-0x0000000003FB0000-0x0000000003FB1000-memory.dmpFilesize
4KB
-
memory/1168-30-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1168-99-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-109-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1168-14-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-11-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-8-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-37-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-82-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-39-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-40-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-41-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-43-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-44-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-77-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-101-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-58-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-6-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-119-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1168-13-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-75-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-91-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-90-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-84-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-88-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1168-86-0x00000000007F0000-0x00000000018AA000-memory.dmpFilesize
16.7MB
-
memory/1464-69-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1464-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1464-74-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1464-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1464-152-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4636-64-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4636-123-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4636-65-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4636-36-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4636-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4780-4-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4780-29-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/4780-20-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/4780-28-0x0000000004220000-0x0000000004221000-memory.dmpFilesize
4KB
-
memory/4780-24-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/4784-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4784-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4784-153-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4784-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4784-67-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4784-148-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4784-144-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB