Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:48
Behavioral task
behavioral1
Sample
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
5b6f02c5bb34856edef5cdc9221fd240
-
SHA1
79c9d4b9c9268791bc9b6d3d57abd1fbeffae70a
-
SHA256
5c9d5959167f2a880e8ccca4b2922db8e59997a6d7ac86e37b94fe89bb14bcca
-
SHA512
30690107120881f8aa12a6d0518f56cde74d1c44e9c726a0e66c6503263aa3f9f208bf59a51b2126ca8a23c0919b9dbef4cb1c9046a752e96d0805beaa70ee31
-
SSDEEP
12288:sl+4Tcyct/JWT7yckBlepmbMsBXYHOWyAh5+djVyKDGpiRe7FaS+ug82qGeJ3btU:xyc5JWackYm7dZ1Oq2nn2qPJ3btV3+f
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1896 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 876 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3400 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2984 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2728 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2020 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4776 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2604 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1040 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 5052 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4612 5052 schtasks.exe -
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/5104-1-0x0000000000D10000-0x0000000000E30000-memory.dmp dcrat C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe dcrat C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe dcrat C:\Users\Admin\SppExtComObj.exe dcrat C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe dcrat behavioral2/memory/4940-269-0x00000000005E0000-0x0000000000700000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2616 powershell.exe 3664 powershell.exe 1676 powershell.exe 2060 powershell.exe 4244 powershell.exe 4652 powershell.exe 2348 powershell.exe 2500 powershell.exe 3176 powershell.exe 3608 powershell.exe 4432 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 4940 explorer.exe -
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Drops file in Program Files directory 10 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\RCX9C0F.tmp 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\7a0fd90576e088 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\RCX9504.tmp 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\RCX9505.tmp 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\dwm.exe 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\dwm.exe 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\6cb0b6c459d5d3 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\RCX9C7E.tmp 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe -
Drops file in Windows directory 5 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exedescription ioc process File created C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File created C:\Windows\DiagTrack\Scenarios\9e8d7a4ca61bd9 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Windows\DiagTrack\Scenarios\RCX970A.tmp 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Windows\DiagTrack\Scenarios\RCX9778.tmp 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe File opened for modification C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2020 schtasks.exe 4380 schtasks.exe 1500 schtasks.exe 2152 schtasks.exe 4612 schtasks.exe 1896 schtasks.exe 1040 schtasks.exe 1044 schtasks.exe 876 schtasks.exe 2984 schtasks.exe 2728 schtasks.exe 4776 schtasks.exe 1416 schtasks.exe 2604 schtasks.exe 316 schtasks.exe 3400 schtasks.exe 1668 schtasks.exe 3856 schtasks.exe 3236 schtasks.exe 2340 schtasks.exe 2540 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeexplorer.exepid process 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe 2500 powershell.exe 2500 powershell.exe 3176 powershell.exe 3176 powershell.exe 4244 powershell.exe 4244 powershell.exe 2616 powershell.exe 2616 powershell.exe 1676 powershell.exe 1676 powershell.exe 3608 powershell.exe 3608 powershell.exe 2060 powershell.exe 2060 powershell.exe 4652 powershell.exe 4652 powershell.exe 3664 powershell.exe 3664 powershell.exe 4432 powershell.exe 4432 powershell.exe 2348 powershell.exe 2348 powershell.exe 2500 powershell.exe 3176 powershell.exe 4244 powershell.exe 2616 powershell.exe 3664 powershell.exe 2060 powershell.exe 4652 powershell.exe 3608 powershell.exe 1676 powershell.exe 4432 powershell.exe 2348 powershell.exe 4940 explorer.exe 4940 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 4244 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeDebugPrivilege 3608 powershell.exe Token: SeDebugPrivilege 2060 powershell.exe Token: SeDebugPrivilege 4652 powershell.exe Token: SeDebugPrivilege 3664 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeDebugPrivilege 2348 powershell.exe Token: SeDebugPrivilege 4940 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exedescription pid process target process PID 5104 wrote to memory of 2616 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2616 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 3664 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 3664 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 1676 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 1676 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4652 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4652 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2348 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2348 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2060 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2060 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2500 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 2500 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 3176 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 3176 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 3608 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 3608 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4432 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4432 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4244 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4244 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe powershell.exe PID 5104 wrote to memory of 4940 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe explorer.exe PID 5104 wrote to memory of 4940 5104 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe explorer.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5b6f02c5bb34856edef5cdc9221fd240_NeikiAnalytics.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe"C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Documents\My Videos\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Videos\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Documents\My Videos\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\Public\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Templates\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\Templates\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Admin\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exeFilesize
1.1MB
MD55ca83868639d6d7ff1f0a19fb08efc07
SHA1238f24ba4038dae051c08091401a66181e1837c2
SHA25685f3e52335530c8dd201247a14d1c71df815d03b6d87406df74b61efd91ed154
SHA5122f7183dacc089de910dea786baa25b496c7f8464598ec4e4f91dc62a2a20f701bb9ca85d627f280a9d82591b562016feca2b2f2d376773a64c8244a3e7960bb4
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
435B
MD5f4345cbce38daa7e18c02ca22fb0c000
SHA124c67eeaf23861c3baf30b8d780f5947e45f7db6
SHA256a407a37e8ccfb1d2593c9391bb0498f3d4c907ae11a0b502223f91de4804c3a9
SHA512df20a4d6a0a4cae71b5b8ba63eab100aa05eadbec74409d99206eb416c35ebfa63bbb17af5443b230d23dcf7208420ea78fefe0803e656de5552a619fad3d6aa
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ddqrsml.1x4.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\SppExtComObj.exeFilesize
1.1MB
MD50d4ddc7bcd8241983b37c29d6094cb6a
SHA1aa2d7183cabdf72a16babe6c73a4d8c4c2cac905
SHA25634307b89dd692e5c14f9b393dc7c91e0086478ad5e8c5acf688e965f395c5d50
SHA512a2898b53ef046d8a3fc0306f5807dc28b11757df58985fa3b2677935de48d356a8de0130d397f91fd6d5e7c5f91725febe37271422d4cef0bf4d4af13bc9b14a
-
C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exeFilesize
1.1MB
MD55b6f02c5bb34856edef5cdc9221fd240
SHA179c9d4b9c9268791bc9b6d3d57abd1fbeffae70a
SHA2565c9d5959167f2a880e8ccca4b2922db8e59997a6d7ac86e37b94fe89bb14bcca
SHA51230690107120881f8aa12a6d0518f56cde74d1c44e9c726a0e66c6503263aa3f9f208bf59a51b2126ca8a23c0919b9dbef4cb1c9046a752e96d0805beaa70ee31
-
C:\Windows\DiagTrack\Scenarios\RuntimeBroker.exeFilesize
1.1MB
MD57fed582682ab6ca0ee32cadc0a3c3b4c
SHA1f4f3682af369da165f49c2f911760972e39268d6
SHA256c4f244835ed36059bee92e1d88e0dc8844b383759e7842504c4877c948342d20
SHA51289c74822d7446d64b70fce522a78e19991ac4e17bd0b8b0da41e81392fbd0baa28c3dc914ea63b62e0219474046b20e58790c0da8e4ce5ba808149e0a30fa3d2
-
memory/2500-163-0x000001C15FEE0000-0x000001C15FF02000-memory.dmpFilesize
136KB
-
memory/4940-269-0x00000000005E0000-0x0000000000700000-memory.dmpFilesize
1.1MB
-
memory/5104-5-0x0000000003050000-0x0000000003060000-memory.dmpFilesize
64KB
-
memory/5104-270-0x00007FFDAE390000-0x00007FFDAEE51000-memory.dmpFilesize
10.8MB
-
memory/5104-2-0x00007FFDAE390000-0x00007FFDAEE51000-memory.dmpFilesize
10.8MB
-
memory/5104-0-0x00007FFDAE393000-0x00007FFDAE395000-memory.dmpFilesize
8KB
-
memory/5104-3-0x00000000014E0000-0x00000000014EE000-memory.dmpFilesize
56KB
-
memory/5104-7-0x0000000003080000-0x000000000308C000-memory.dmpFilesize
48KB
-
memory/5104-8-0x000000001BA70000-0x000000001BA7C000-memory.dmpFilesize
48KB
-
memory/5104-4-0x0000000003040000-0x0000000003048000-memory.dmpFilesize
32KB
-
memory/5104-1-0x0000000000D10000-0x0000000000E30000-memory.dmpFilesize
1.1MB
-
memory/5104-6-0x0000000003060000-0x000000000306A000-memory.dmpFilesize
40KB