Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 04:05
Static task
static1
Behavioral task
behavioral1
Sample
1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll
Resource
win7-20240215-en
General
-
Target
1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll
-
Size
120KB
-
MD5
1a87df78564ed2cbcca969affa42d240
-
SHA1
4a2d0c583557d69cffc878eaf96adae7831734ea
-
SHA256
17fafc3a0ec9df8f0c1f46460a88320d888feead12564b1c8f17175668174ea6
-
SHA512
5582ae29605d278c82dac9f1f23b3ea753ea046277be4413c3e364bde834cdfb8c5017ac8ba68d3c287edb144f83043823b16b289c4d3b32de80a7fd8e635367
-
SSDEEP
1536:ij5cZ3kyoIcSOPO3lgTZ1Src4veXXeFBGy0wpxSRrpcNOjaubf/IXMIbHd2m:i9c/oIcSO23lgEvmIBNBSbMMYv
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 9 IoCs
Processes:
e573865.exee575880.exee5735c5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573865.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575880.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575880.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573865.exe -
Processes:
e5735c5.exee573865.exee575880.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575880.exe -
Processes:
e573865.exee575880.exee5735c5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5735c5.exe -
Executes dropped EXE 3 IoCs
Processes:
e5735c5.exee573865.exee575880.exepid process 3648 e5735c5.exe 4560 e573865.exe 4252 e575880.exe -
Processes:
resource yara_rule behavioral2/memory/3648-8-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-6-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-17-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-13-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-15-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-22-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-16-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-12-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-11-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-10-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-9-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-36-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-37-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-38-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-40-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-39-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-42-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-43-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-52-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-54-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-63-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-65-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-66-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-69-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-71-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-74-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-75-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-78-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-79-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/3648-81-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/4560-110-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4560-129-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Processes:
e5735c5.exee573865.exee575880.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5735c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5735c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575880.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575880.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5735c5.exe -
Processes:
e5735c5.exee573865.exee575880.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575880.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e5735c5.exedescription ioc process File opened (read-only) \??\N: e5735c5.exe File opened (read-only) \??\P: e5735c5.exe File opened (read-only) \??\Q: e5735c5.exe File opened (read-only) \??\H: e5735c5.exe File opened (read-only) \??\J: e5735c5.exe File opened (read-only) \??\L: e5735c5.exe File opened (read-only) \??\K: e5735c5.exe File opened (read-only) \??\M: e5735c5.exe File opened (read-only) \??\O: e5735c5.exe File opened (read-only) \??\E: e5735c5.exe File opened (read-only) \??\G: e5735c5.exe File opened (read-only) \??\I: e5735c5.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e5735c5.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e5735c5.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5735c5.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5735c5.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5735c5.exe -
Drops file in Windows directory 4 IoCs
Processes:
e5735c5.exee573865.exee575880.exedescription ioc process File created C:\Windows\e5735f4 e5735c5.exe File opened for modification C:\Windows\SYSTEM.INI e5735c5.exe File created C:\Windows\e57880c e573865.exe File created C:\Windows\e57a6ee e575880.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e5735c5.exee573865.exee575880.exepid process 3648 e5735c5.exe 3648 e5735c5.exe 3648 e5735c5.exe 3648 e5735c5.exe 4560 e573865.exe 4560 e573865.exe 4252 e575880.exe 4252 e575880.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e5735c5.exedescription pid process Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe Token: SeDebugPrivilege 3648 e5735c5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee5735c5.exee573865.exedescription pid process target process PID 4448 wrote to memory of 4564 4448 rundll32.exe rundll32.exe PID 4448 wrote to memory of 4564 4448 rundll32.exe rundll32.exe PID 4448 wrote to memory of 4564 4448 rundll32.exe rundll32.exe PID 4564 wrote to memory of 3648 4564 rundll32.exe e5735c5.exe PID 4564 wrote to memory of 3648 4564 rundll32.exe e5735c5.exe PID 4564 wrote to memory of 3648 4564 rundll32.exe e5735c5.exe PID 3648 wrote to memory of 768 3648 e5735c5.exe fontdrvhost.exe PID 3648 wrote to memory of 776 3648 e5735c5.exe fontdrvhost.exe PID 3648 wrote to memory of 384 3648 e5735c5.exe dwm.exe PID 3648 wrote to memory of 2608 3648 e5735c5.exe sihost.exe PID 3648 wrote to memory of 2640 3648 e5735c5.exe svchost.exe PID 3648 wrote to memory of 2748 3648 e5735c5.exe taskhostw.exe PID 3648 wrote to memory of 3464 3648 e5735c5.exe Explorer.EXE PID 3648 wrote to memory of 3600 3648 e5735c5.exe svchost.exe PID 3648 wrote to memory of 3784 3648 e5735c5.exe DllHost.exe PID 3648 wrote to memory of 3876 3648 e5735c5.exe StartMenuExperienceHost.exe PID 3648 wrote to memory of 3940 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 4036 3648 e5735c5.exe SearchApp.exe PID 3648 wrote to memory of 4160 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 1336 3648 e5735c5.exe TextInputHost.exe PID 3648 wrote to memory of 4324 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 984 3648 e5735c5.exe backgroundTaskHost.exe PID 3648 wrote to memory of 3312 3648 e5735c5.exe backgroundTaskHost.exe PID 3648 wrote to memory of 4448 3648 e5735c5.exe rundll32.exe PID 3648 wrote to memory of 4564 3648 e5735c5.exe rundll32.exe PID 3648 wrote to memory of 4564 3648 e5735c5.exe rundll32.exe PID 4564 wrote to memory of 4560 4564 rundll32.exe e573865.exe PID 4564 wrote to memory of 4560 4564 rundll32.exe e573865.exe PID 4564 wrote to memory of 4560 4564 rundll32.exe e573865.exe PID 4564 wrote to memory of 4252 4564 rundll32.exe e575880.exe PID 4564 wrote to memory of 4252 4564 rundll32.exe e575880.exe PID 4564 wrote to memory of 4252 4564 rundll32.exe e575880.exe PID 3648 wrote to memory of 768 3648 e5735c5.exe fontdrvhost.exe PID 3648 wrote to memory of 776 3648 e5735c5.exe fontdrvhost.exe PID 3648 wrote to memory of 384 3648 e5735c5.exe dwm.exe PID 3648 wrote to memory of 2608 3648 e5735c5.exe sihost.exe PID 3648 wrote to memory of 2640 3648 e5735c5.exe svchost.exe PID 3648 wrote to memory of 2748 3648 e5735c5.exe taskhostw.exe PID 3648 wrote to memory of 3464 3648 e5735c5.exe Explorer.EXE PID 3648 wrote to memory of 3600 3648 e5735c5.exe svchost.exe PID 3648 wrote to memory of 3784 3648 e5735c5.exe DllHost.exe PID 3648 wrote to memory of 3876 3648 e5735c5.exe StartMenuExperienceHost.exe PID 3648 wrote to memory of 3940 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 4036 3648 e5735c5.exe SearchApp.exe PID 3648 wrote to memory of 4160 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 1336 3648 e5735c5.exe TextInputHost.exe PID 3648 wrote to memory of 4324 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 984 3648 e5735c5.exe backgroundTaskHost.exe PID 3648 wrote to memory of 4560 3648 e5735c5.exe e573865.exe PID 3648 wrote to memory of 4560 3648 e5735c5.exe e573865.exe PID 3648 wrote to memory of 1444 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 4648 3648 e5735c5.exe RuntimeBroker.exe PID 3648 wrote to memory of 4252 3648 e5735c5.exe e575880.exe PID 3648 wrote to memory of 4252 3648 e5735c5.exe e575880.exe PID 4560 wrote to memory of 768 4560 e573865.exe fontdrvhost.exe PID 4560 wrote to memory of 776 4560 e573865.exe fontdrvhost.exe PID 4560 wrote to memory of 384 4560 e573865.exe dwm.exe PID 4560 wrote to memory of 2608 4560 e573865.exe sihost.exe PID 4560 wrote to memory of 2640 4560 e573865.exe svchost.exe PID 4560 wrote to memory of 2748 4560 e573865.exe taskhostw.exe PID 4560 wrote to memory of 3464 4560 e573865.exe Explorer.EXE PID 4560 wrote to memory of 3600 4560 e573865.exe svchost.exe PID 4560 wrote to memory of 3784 4560 e573865.exe DllHost.exe PID 4560 wrote to memory of 3876 4560 e573865.exe StartMenuExperienceHost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
e5735c5.exee573865.exee575880.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5735c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573865.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575880.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a87df78564ed2cbcca969affa42d240_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5735c5.exeC:\Users\Admin\AppData\Local\Temp\e5735c5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e573865.exeC:\Users\Admin\AppData\Local\Temp\e573865.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e575880.exeC:\Users\Admin\AppData\Local\Temp\e575880.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e5735c5.exeFilesize
97KB
MD56310c73bcd7044acdbe7c23df589dfbc
SHA1b066d009828ac0c60480f8786f3806391df4edff
SHA256c80168fe2ce1e21d3942726eb9a2265ff52188eb4c1a7c035398388615be0551
SHA5126e114d519969aff876e17bd35ad6047d75d9e527955b64152073c43ec4638988d1724630a53c44a16354b9b4b2ee6e0fe3ab1076e8608babf09fe90200308dc9
-
C:\Windows\SYSTEM.INIFilesize
256B
MD5ee489fa138324db5e1a94c52a9413799
SHA1b2e8502e3b882018c5068972fbf8d43d1684a062
SHA256a628c6206c0bf9f4b0ac6a44e8f38640cae23f3791fe80623e379d59205f594c
SHA512fad2549978609b46008cf729177083cdedfd7cb7ac93555ac6b8c5576108d48c2965686e2599bb3b82c3bb1bd5dee6aa2b25b4b3355e63e68ba6811a3bb7bace
-
memory/3648-39-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-37-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-6-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-17-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-13-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-15-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-22-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-71-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-69-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-34-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/3648-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3648-30-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/3648-28-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/3648-52-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-81-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-16-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-12-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-11-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-10-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-9-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-36-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-74-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-38-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-40-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-43-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-42-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-84-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/3648-8-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-98-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3648-54-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-79-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-78-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-75-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-66-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-65-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/3648-63-0x0000000000810000-0x00000000018CA000-memory.dmpFilesize
16.7MB
-
memory/4252-62-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4252-61-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4252-59-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/4252-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4252-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4560-128-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4560-60-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/4560-56-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/4560-57-0x00000000001F0000-0x00000000001F2000-memory.dmpFilesize
8KB
-
memory/4560-110-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4560-35-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4560-129-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/4564-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4564-23-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB
-
memory/4564-26-0x0000000004340000-0x0000000004341000-memory.dmpFilesize
4KB
-
memory/4564-33-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB
-
memory/4564-24-0x0000000004330000-0x0000000004332000-memory.dmpFilesize
8KB