Analysis
-
max time kernel
144s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:36
Static task
static1
Behavioral task
behavioral1
Sample
5931a5637c4e44b77332c50559eae270_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
5931a5637c4e44b77332c50559eae270_NeikiAnalytics.dll
-
Size
120KB
-
MD5
5931a5637c4e44b77332c50559eae270
-
SHA1
80abc5d7c8780ee1e34493b5d54c15f00e5f6227
-
SHA256
e282d0b240abcd4abb3cef839a309ce5be986c4116177515fa123ee535768dac
-
SHA512
a1a44afc96427129a5fb1902924fadf64c730acc3b69c0a99d5511de86412fa54967ac1bf3ab8e2014e866f0d44fbcc8641fd32832134ca0efddc3df4ef394bf
-
SSDEEP
3072:sEbgy6qShOSXUaZi241dKOe3MxAX+9e4:dbgqSkiv2zYMxQ+e4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
e575360.exee57781e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575360.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575360.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57781e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57781e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57781e.exe -
Processes:
e575360.exee57781e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57781e.exe -
Processes:
e575360.exee57781e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57781e.exe -
Executes dropped EXE 3 IoCs
Processes:
e575360.exee575479.exee57781e.exepid process 2288 e575360.exe 1516 e575479.exe 2636 e57781e.exe -
Processes:
resource yara_rule behavioral2/memory/2288-6-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-26-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-8-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-9-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-24-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-25-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-30-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-34-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-35-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-11-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-10-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-37-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-36-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-38-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-47-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-48-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-58-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-59-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-60-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-62-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-63-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-65-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-67-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-69-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2288-71-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/2636-106-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/2636-142-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e575360.exee57781e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575360.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575360.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57781e.exe -
Processes:
e575360.exee57781e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57781e.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e575360.exee57781e.exedescription ioc process File opened (read-only) \??\K: e575360.exe File opened (read-only) \??\E: e57781e.exe File opened (read-only) \??\G: e57781e.exe File opened (read-only) \??\I: e57781e.exe File opened (read-only) \??\E: e575360.exe File opened (read-only) \??\I: e575360.exe File opened (read-only) \??\J: e575360.exe File opened (read-only) \??\L: e575360.exe File opened (read-only) \??\M: e575360.exe File opened (read-only) \??\H: e57781e.exe File opened (read-only) \??\G: e575360.exe File opened (read-only) \??\H: e575360.exe -
Drops file in Windows directory 3 IoCs
Processes:
e575360.exee57781e.exedescription ioc process File created C:\Windows\e5753bd e575360.exe File opened for modification C:\Windows\SYSTEM.INI e575360.exe File created C:\Windows\e57a652 e57781e.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e575360.exee57781e.exepid process 2288 e575360.exe 2288 e575360.exe 2288 e575360.exe 2288 e575360.exe 2636 e57781e.exe 2636 e57781e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e575360.exedescription pid process Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe Token: SeDebugPrivilege 2288 e575360.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee575360.exee57781e.exedescription pid process target process PID 5080 wrote to memory of 4728 5080 rundll32.exe rundll32.exe PID 5080 wrote to memory of 4728 5080 rundll32.exe rundll32.exe PID 5080 wrote to memory of 4728 5080 rundll32.exe rundll32.exe PID 4728 wrote to memory of 2288 4728 rundll32.exe e575360.exe PID 4728 wrote to memory of 2288 4728 rundll32.exe e575360.exe PID 4728 wrote to memory of 2288 4728 rundll32.exe e575360.exe PID 2288 wrote to memory of 788 2288 e575360.exe fontdrvhost.exe PID 2288 wrote to memory of 792 2288 e575360.exe fontdrvhost.exe PID 2288 wrote to memory of 1020 2288 e575360.exe dwm.exe PID 2288 wrote to memory of 2992 2288 e575360.exe sihost.exe PID 2288 wrote to memory of 3020 2288 e575360.exe svchost.exe PID 2288 wrote to memory of 2280 2288 e575360.exe taskhostw.exe PID 2288 wrote to memory of 3372 2288 e575360.exe Explorer.EXE PID 2288 wrote to memory of 3548 2288 e575360.exe svchost.exe PID 2288 wrote to memory of 3760 2288 e575360.exe DllHost.exe PID 2288 wrote to memory of 3856 2288 e575360.exe StartMenuExperienceHost.exe PID 2288 wrote to memory of 3956 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 4060 2288 e575360.exe SearchApp.exe PID 2288 wrote to memory of 4116 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 4712 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 3980 2288 e575360.exe TextInputHost.exe PID 2288 wrote to memory of 3648 2288 e575360.exe backgroundTaskHost.exe PID 2288 wrote to memory of 3264 2288 e575360.exe backgroundTaskHost.exe PID 2288 wrote to memory of 5080 2288 e575360.exe rundll32.exe PID 2288 wrote to memory of 4728 2288 e575360.exe rundll32.exe PID 2288 wrote to memory of 4728 2288 e575360.exe rundll32.exe PID 4728 wrote to memory of 1516 4728 rundll32.exe e575479.exe PID 4728 wrote to memory of 1516 4728 rundll32.exe e575479.exe PID 4728 wrote to memory of 1516 4728 rundll32.exe e575479.exe PID 4728 wrote to memory of 2636 4728 rundll32.exe e57781e.exe PID 4728 wrote to memory of 2636 4728 rundll32.exe e57781e.exe PID 4728 wrote to memory of 2636 4728 rundll32.exe e57781e.exe PID 2288 wrote to memory of 788 2288 e575360.exe fontdrvhost.exe PID 2288 wrote to memory of 792 2288 e575360.exe fontdrvhost.exe PID 2288 wrote to memory of 1020 2288 e575360.exe dwm.exe PID 2288 wrote to memory of 2992 2288 e575360.exe sihost.exe PID 2288 wrote to memory of 3020 2288 e575360.exe svchost.exe PID 2288 wrote to memory of 2280 2288 e575360.exe taskhostw.exe PID 2288 wrote to memory of 3372 2288 e575360.exe Explorer.EXE PID 2288 wrote to memory of 3548 2288 e575360.exe svchost.exe PID 2288 wrote to memory of 3760 2288 e575360.exe DllHost.exe PID 2288 wrote to memory of 3856 2288 e575360.exe StartMenuExperienceHost.exe PID 2288 wrote to memory of 3956 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 4060 2288 e575360.exe SearchApp.exe PID 2288 wrote to memory of 4116 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 4712 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 3980 2288 e575360.exe TextInputHost.exe PID 2288 wrote to memory of 3648 2288 e575360.exe backgroundTaskHost.exe PID 2288 wrote to memory of 3264 2288 e575360.exe backgroundTaskHost.exe PID 2288 wrote to memory of 1516 2288 e575360.exe e575479.exe PID 2288 wrote to memory of 1516 2288 e575360.exe e575479.exe PID 2288 wrote to memory of 4624 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 636 2288 e575360.exe RuntimeBroker.exe PID 2288 wrote to memory of 2636 2288 e575360.exe e57781e.exe PID 2288 wrote to memory of 2636 2288 e575360.exe e57781e.exe PID 2636 wrote to memory of 788 2636 e57781e.exe fontdrvhost.exe PID 2636 wrote to memory of 792 2636 e57781e.exe fontdrvhost.exe PID 2636 wrote to memory of 1020 2636 e57781e.exe dwm.exe PID 2636 wrote to memory of 2992 2636 e57781e.exe sihost.exe PID 2636 wrote to memory of 3020 2636 e57781e.exe svchost.exe PID 2636 wrote to memory of 2280 2636 e57781e.exe taskhostw.exe PID 2636 wrote to memory of 3372 2636 e57781e.exe Explorer.EXE PID 2636 wrote to memory of 3548 2636 e57781e.exe svchost.exe PID 2636 wrote to memory of 3760 2636 e57781e.exe DllHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e57781e.exee575360.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57781e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575360.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5931a5637c4e44b77332c50559eae270_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5931a5637c4e44b77332c50559eae270_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e575360.exeC:\Users\Admin\AppData\Local\Temp\e575360.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e575479.exeC:\Users\Admin\AppData\Local\Temp\e575479.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e57781e.exeC:\Users\Admin\AppData\Local\Temp\e57781e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e575360.exeFilesize
97KB
MD574f0d426a5026f5639e16476d6a80aa8
SHA1f22fa909fee6eb81be345508271a98e62b227bcc
SHA25626f7a780f4581c3187b28bb165e83c132f47e7557c1a8299acf439aa500cfba1
SHA512caae7e0054306860bd90674a9e1ed5d38d7eae12e739209dcaf45522ee247819457dd3cb7fd0bee056cf0fc45d4642d7c28a2058d908ca7adc53e7e24cbccb00
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ad091412b5702c3c180db47737fa3ee0
SHA144a6ce1f47c8ea83c49bb1f12beda1f21db4b32f
SHA2562c129ab248b057223a764ebd025bf4800baa7f2546e947a4525f3b55b0048141
SHA5125718fafa00cf881aea9122afc6397a5ae01ac6dba1bc2361276c1def61025ce45f1166126e845152011bfa4dcffda4a2aa613eca685863967442fccc8e47dc2e
-
memory/1516-33-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1516-94-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1516-56-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1516-50-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1516-53-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2288-38-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-37-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-30-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-34-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-35-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-32-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2288-11-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-27-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2288-10-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-15-0x0000000003D30000-0x0000000003D31000-memory.dmpFilesize
4KB
-
memory/2288-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2288-6-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-90-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2288-81-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/2288-71-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-63-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-36-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-24-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-69-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-47-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-48-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-25-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-9-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-67-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-8-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-65-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-26-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-58-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-59-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-60-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2288-62-0x0000000000800000-0x00000000018BA000-memory.dmpFilesize
16.7MB
-
memory/2636-54-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2636-57-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2636-52-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2636-46-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2636-106-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/2636-143-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2636-142-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4728-12-0x0000000000D20000-0x0000000000D22000-memory.dmpFilesize
8KB
-
memory/4728-13-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/4728-18-0x0000000000D20000-0x0000000000D22000-memory.dmpFilesize
8KB
-
memory/4728-31-0x0000000000D20000-0x0000000000D22000-memory.dmpFilesize
8KB
-
memory/4728-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB