53c9aaa80daf28d00963a073e9e159488f66806c62347f7dc06a29261b1ed455

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Size 63KB
Sample240526-vkf6ssde2v
SHA256 53c9aaa80daf28d00963a073e9e159488f66806c62347f7dc06a29261b1ed455
MD5 1641e6bef06dd094ccc1ecb7c6b17ee0
SHA1 93f6d776feebf1918efd80298e1550f913d7ff83
SHA512 7f527a1d526968b078a6ec3ac770505b9ba4f0d40b1fbf8c9ceb0c86ece62633ca59d08505a072552bbdfdd56d30275e8a26ca4df74b6ef1acb1e4730e57ea5b
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDN/BAG4RsfU:jOm9CshoutdVj4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1064	xk.exe
4724	IExplorer.exe
436	WINLOGON.EXE
4268	CSRSS.EXE
2948	SERVICES.EXE
4548	LSASS.EXE
4636	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4556-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023415-8.dat	upx
behavioral2/files/0x000700000002341a-107.dat	upx
behavioral2/memory/1064-110-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x000700000002341e-113.dat	upx
behavioral2/memory/4724-117-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023420-119.dat	upx
behavioral2/memory/436-123-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023421-126.dat	upx
behavioral2/memory/4268-130-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023422-132.dat	upx
behavioral2/memory/2948-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4548-141-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023423-140.dat	upx
behavioral2/memory/4548-146-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/files/0x0007000000023424-147.dat	upx
behavioral2/memory/4636-152-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral2/memory/4556-153-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mig2.scr	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
1064	xk.exe
4724	IExplorer.exe
436	WINLOGON.EXE
4268	CSRSS.EXE
2948	SERVICES.EXE
4548	LSASS.EXE
4636	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1064	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	83
PID 4556 wrote to memory of 1064	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	83
PID 4556 wrote to memory of 1064	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	83
PID 4556 wrote to memory of 4724	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	84
PID 4556 wrote to memory of 4724	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	84
PID 4556 wrote to memory of 4724	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	84
PID 4556 wrote to memory of 436	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	85
PID 4556 wrote to memory of 436	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	85
PID 4556 wrote to memory of 436	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	85
PID 4556 wrote to memory of 4268	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	86
PID 4556 wrote to memory of 4268	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	86
PID 4556 wrote to memory of 4268	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	86
PID 4556 wrote to memory of 2948	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	87
PID 4556 wrote to memory of 2948	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	87
PID 4556 wrote to memory of 2948	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	87
PID 4556 wrote to memory of 4548	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	88
PID 4556 wrote to memory of 4548	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	88
PID 4556 wrote to memory of 4548	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	88
PID 4556 wrote to memory of 4636	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	89
PID 4556 wrote to memory of 4636	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	89
PID 4556 wrote to memory of 4636	4556	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe	89

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1641e6bef06dd094ccc1ecb7c6b17ee0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4556
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1064
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4724
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:436
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4268
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2948
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4548
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 63KB
SHA256 ec408c781015fffc5fb381f95b76c29b08a3a123c528608021d1baeec024d928
MD5 91d167942b0abfa9e42016c02f954752
SHA1 b0987c2da2e099bf1ab9d84c38c2cafec4dded8e
SHA512 191099fb98ac5d4fe2cdb83943672711f7a0abb748d1e9754fa7ddfb182cbe13422b48f0bce86be396907fdd5415800a2e28d7e5b95a5fc90aa4cef7b404e578
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VD/BAG4RsfU:jOm9Cshoutd/j4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 63KB
SHA256 fdd99ac61ba71640aa7037ff6f755c935af51c28b6cc215b8505035c18d4f7fc
MD5 86a23e798f9a1ad7618d6560d95ff311
SHA1 0509ab787256ed7e7eac90684788c2896c435029
SHA512 6281bcfd77605d88b8110768023d8ed13ae5e3275a654561617064dd414c6811d3922ac6319534b6f4cebe5ca215d10905745548866aefb14ca0bfb24f9c10e9
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDhBAG4RsfU:jOm9Cshoutdhj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 63KB
SHA256 a12f0a145411a42479deea08e992f3655b3d65acc9bd00de6ff8878cc40549ec
MD5 87b2f7e57b8015e55d29af6d7f215d58
SHA1 1952cff15d83eea5ccf80004fe73eecd3c93f68b
SHA512 0e4560c5ab469f813f550e5fa42e7017ef781b3490589c4f606768c77374de5882b416fb1a2013d457684b6fa3b535dd913a0c91580de84ea49cf7fd21c318c9
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDqBAG4RsfU:jOm9Cshoutdqj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 63KB
SHA256 53c9aaa80daf28d00963a073e9e159488f66806c62347f7dc06a29261b1ed455
MD5 1641e6bef06dd094ccc1ecb7c6b17ee0
SHA1 93f6d776feebf1918efd80298e1550f913d7ff83
SHA512 7f527a1d526968b078a6ec3ac770505b9ba4f0d40b1fbf8c9ceb0c86ece62633ca59d08505a072552bbdfdd56d30275e8a26ca4df74b6ef1acb1e4730e57ea5b
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDN/BAG4RsfU:jOm9CshoutdVj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Size 63KB
SHA256 cdf99324e40f8b724393a7f0fa6df69260b06ef1df3d495f4b87bb0d8a4d2d7c
MD5 9dcc863d4700b415f27339626523c5a9
SHA1 2f5c53dfcf52919ab6349ca4180220b924836f8a
SHA512 80e3c050acf65eaac52fb1f809472d4a417ac215ce989d0838d46c9da816ec8875a38fa92ef3489eb530a7be56f7bfeab52908bbb4ae109cc476e1bb560815e2
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDcBAG4RsfU:jOm9Cshoutdcj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Size 63KB
SHA256 10f2748996e3fe18b4c40dce559cc66f5b453ff6cfe674c11f36871472d971cd
MD5 cbbbea401e7ca927caa50567d2597e23
SHA1 71cd1c80bb8babdc93aa94c2905a710ca7c59eef
SHA512 b820c53e50771bafb109ba1d1b8c1901104e52da8a63a0cc50fc57cd2e3d106f27c4724f01a6c65e7827ef3044a01b91cb84f2f6c753419555afb453ce7f0506
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VD4BAG4RsfU:jOm9Cshoutd4j4
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 63KB
SHA256 2b98f3454d6bab37e7ce41e0e737441b914a15881d7341da8ee73fbb213efa20
MD5 334775ca78b7eedf9fcfad02ee6e1fa1
SHA1 e4c0f191189d1f204c6b3331f869bd471c107b2f
SHA512 05db5ce511f5e40dc91ab15bda1aabc41f103d740da8eb6f8c4cf02d52e086699a087d61fee369b92049275839eed4e04cdf833974842be97d3b070965d8565a
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDIBAG4RsfU:jOm9CshoutdIj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 63KB
SHA256 c49d134c7ccd117f06dcee15ca3c8737af58941d7d1b161ccbfb948772b19f16
MD5 23e49f7a70bc29d62682417409c9b837
SHA1 0cf4e338d1cec2b109d63ac4e7e2cc43f2b1e519
SHA512 9e466a174f79ea4347de08a216f7bdbb8b098da34d9ae0a455517639cd9beeead610a915decba248fe84db179da08f044a18a59eed43b28053660a5c2c2177b7
SSDEEP 1536:jRsjdEIUFC2p79OCnouy8VDBBAG4RsfU:jOm9CshoutdBj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-123-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1064-110-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2948-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4268-130-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4548-141-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4548-146-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4556-153-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4636-152-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4724-117-0x0000000000400000-0x000000000042F000-memory.dmp

Download