99121c8c83275d1de3d651d9c7c407babda1cef3ce82f723d7a1a3f5411e3ba2

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe
Size

98KB
MD5

31c251ad1ebf3c9ee205f8b28b335b30
SHA1

6b0cc2ee0dba27226e916203e69b92116e7e174a
SHA256

99121c8c83275d1de3d651d9c7c407babda1cef3ce82f723d7a1a3f5411e3ba2
SHA512

0832b6a626eedec5f5c522e5e8108188824bc37a9aaa6a96db9db1c75624bb09bfb6864c480474e6ccee1f9cdc3697e08c2e62737c559f4db643e90a6f684445
SSDEEP

768:5vw981sthKQLrod4/wQDNrfrunMxVFA3b7glws:lEGN0odlounMxVS3Hgz

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41998565-9C9A-46a2-A871-3DB1C88C1E20}\stubpath = "C:\\Windows\\{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe"	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE4FCCB1-F339-4307-948C-3205428F033C}\stubpath = "C:\\Windows\\{EE4FCCB1-F339-4307-948C-3205428F033C}.exe"	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13401A38-B22A-403d-89E1-C262E41F15DC}	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6976D53-918D-4c75-8042-5581854B090E}\stubpath = "C:\\Windows\\{C6976D53-918D-4c75-8042-5581854B090E}.exe"	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}	{C6976D53-918D-4c75-8042-5581854B090E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41998565-9C9A-46a2-A871-3DB1C88C1E20}	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6976D53-918D-4c75-8042-5581854B090E}	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE4FCCB1-F339-4307-948C-3205428F033C}	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1578E384-16AF-4012-B6F9-F6B64A725464}\stubpath = "C:\\Windows\\{1578E384-16AF-4012-B6F9-F6B64A725464}.exe"	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E452F217-C283-4488-8BBD-BEC1CD004F4B}\stubpath = "C:\\Windows\\{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe"	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13401A38-B22A-403d-89E1-C262E41F15DC}\stubpath = "C:\\Windows\\{13401A38-B22A-403d-89E1-C262E41F15DC}.exe"	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}\stubpath = "C:\\Windows\\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe"	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AF06D94-A593-4501-8133-AAF3AA34BD94}\stubpath = "C:\\Windows\\{9AF06D94-A593-4501-8133-AAF3AA34BD94}.exe"	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}\stubpath = "C:\\Windows\\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe"	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}\stubpath = "C:\\Windows\\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe"	{C6976D53-918D-4c75-8042-5581854B090E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1578E384-16AF-4012-B6F9-F6B64A725464}	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E452F217-C283-4488-8BBD-BEC1CD004F4B}	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}\stubpath = "C:\\Windows\\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe"	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AF06D94-A593-4501-8133-AAF3AA34BD94}	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe

Executes dropped EXE 11 IoCs

pid	Process
2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe
4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe
5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
3848	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe
3400	{9AF06D94-A593-4501-8133-AAF3AA34BD94}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
File created	C:\Windows\{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
File created	C:\Windows\{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
File created	C:\Windows\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
File created	C:\Windows\{C6976D53-918D-4c75-8042-5581854B090E}.exe	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
File created	C:\Windows\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	{C6976D53-918D-4c75-8042-5581854B090E}.exe
File created	C:\Windows\{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
File created	C:\Windows\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
File created	C:\Windows\{9AF06D94-A593-4501-8133-AAF3AA34BD94}.exe	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe
File created	C:\Windows\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe
File created	C:\Windows\{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
Token: SeIncBasePriorityPrivilege	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe
Token: SeIncBasePriorityPrivilege	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe
Token: SeIncBasePriorityPrivilege	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
Token: SeIncBasePriorityPrivilege	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
Token: SeIncBasePriorityPrivilege	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
Token: SeIncBasePriorityPrivilege	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
Token: SeIncBasePriorityPrivilege	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
Token: SeIncBasePriorityPrivilege	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
Token: SeIncBasePriorityPrivilege	3848	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2084	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe	91
PID 940 wrote to memory of 2084	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe	91
PID 940 wrote to memory of 2084	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe	91
PID 940 wrote to memory of 3652	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe	92
PID 940 wrote to memory of 3652	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe	92
PID 940 wrote to memory of 3652	940	31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe	92
PID 2084 wrote to memory of 3556	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	98
PID 2084 wrote to memory of 3556	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	98
PID 2084 wrote to memory of 3556	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	98
PID 2084 wrote to memory of 3748	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	99
PID 2084 wrote to memory of 3748	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	99
PID 2084 wrote to memory of 3748	2084	{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe	99
PID 3556 wrote to memory of 4548	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe	104
PID 3556 wrote to memory of 4548	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe	104
PID 3556 wrote to memory of 4548	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe	104
PID 3556 wrote to memory of 4208	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe	105
PID 3556 wrote to memory of 4208	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe	105
PID 3556 wrote to memory of 4208	3556	{C6976D53-918D-4c75-8042-5581854B090E}.exe	105
PID 4548 wrote to memory of 5072	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	106
PID 4548 wrote to memory of 5072	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	106
PID 4548 wrote to memory of 5072	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	106
PID 4548 wrote to memory of 4492	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	107
PID 4548 wrote to memory of 4492	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	107
PID 4548 wrote to memory of 4492	4548	{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe	107
PID 5072 wrote to memory of 4524	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	108
PID 5072 wrote to memory of 4524	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	108
PID 5072 wrote to memory of 4524	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	108
PID 5072 wrote to memory of 3284	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	109
PID 5072 wrote to memory of 3284	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	109
PID 5072 wrote to memory of 3284	5072	{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe	109
PID 4524 wrote to memory of 2156	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	110
PID 4524 wrote to memory of 2156	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	110
PID 4524 wrote to memory of 2156	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	110
PID 4524 wrote to memory of 724	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	111
PID 4524 wrote to memory of 724	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	111
PID 4524 wrote to memory of 724	4524	{EE4FCCB1-F339-4307-948C-3205428F033C}.exe	111
PID 2156 wrote to memory of 1480	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	112
PID 2156 wrote to memory of 1480	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	112
PID 2156 wrote to memory of 1480	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	112
PID 2156 wrote to memory of 2876	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	113
PID 2156 wrote to memory of 2876	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	113
PID 2156 wrote to memory of 2876	2156	{1578E384-16AF-4012-B6F9-F6B64A725464}.exe	113
PID 1480 wrote to memory of 4384	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	114
PID 1480 wrote to memory of 4384	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	114
PID 1480 wrote to memory of 4384	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	114
PID 1480 wrote to memory of 3004	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	115
PID 1480 wrote to memory of 3004	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	115
PID 1480 wrote to memory of 3004	1480	{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe	115
PID 4384 wrote to memory of 1100	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	116
PID 4384 wrote to memory of 1100	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	116
PID 4384 wrote to memory of 1100	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	116
PID 4384 wrote to memory of 180	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	117
PID 4384 wrote to memory of 180	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	117
PID 4384 wrote to memory of 180	4384	{13401A38-B22A-403d-89E1-C262E41F15DC}.exe	117
PID 1100 wrote to memory of 3848	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	118
PID 1100 wrote to memory of 3848	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	118
PID 1100 wrote to memory of 3848	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	118
PID 1100 wrote to memory of 4004	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	119
PID 1100 wrote to memory of 4004	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	119
PID 1100 wrote to memory of 4004	1100	{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe	119
PID 3848 wrote to memory of 3400	3848	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe	120
PID 3848 wrote to memory of 3400	3848	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe	120
PID 3848 wrote to memory of 3400	3848	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe	120
PID 3848 wrote to memory of 4212	3848	{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe	121

C:\Users\Admin\AppData\Local\Temp\31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\31c251ad1ebf3c9ee205f8b28b335b30_NeikiAnalytics.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
  C:\Windows\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\{C6976D53-918D-4c75-8042-5581854B090E}.exe
    C:\Windows\{C6976D53-918D-4c75-8042-5581854B090E}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe
      C:\Windows\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Windows\{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
        
        C:\Windows\{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5072
      - C:\Windows\{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
        
        C:\Windows\{EE4FCCB1-F339-4307-948C-3205428F033C}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
        
        C:\Windows\{1578E384-16AF-4012-B6F9-F6B64A725464}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
        
        C:\Windows\{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
        
        C:\Windows\{13401A38-B22A-403d-89E1-C262E41F15DC}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
        
        C:\Windows\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe
        
        C:\Windows\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\{9AF06D94-A593-4501-8133-AAF3AA34BD94}.exe
        
        C:\Windows\{9AF06D94-A593-4501-8133-AAF3AA34BD94}.exe
        12⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0648E~1.EXE > nul
        12⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D382D~1.EXE > nul
        11⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{13401~1.EXE > nul
        10⤵
        
        PID:180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E452F~1.EXE > nul
        9⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1578E~1.EXE > nul
        8⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{EE4FC~1.EXE > nul
        7⤵
        
        PID:724
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{41998~1.EXE > nul
        6⤵
        
        PID:3284
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{97A55~1.EXE > nul
        5⤵
        
        PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C6976~1.EXE > nul
      4⤵
      PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CA13E~1.EXE > nul
    3⤵
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\31C251~1.EXE > nul
  2⤵
  PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0648EDB1-984E-4660-AF86-8C421E9BB4AE}.exe

Filesize
98KB

MD5
c11b6757682125d889b240927ad8a3b8

SHA1
6fd52d867229bd812d34a890aaca99ebdfa9d98c

SHA256
8233033a6a946f7305e6e181ee2b964e887517c3f3118e6fe5a40d2d07836bd8

SHA512
1be54b2e82552df62c7b8bdedcdfc84669e948f1c7b62e5782573a330e0dba64f1104168ce4500832450c4f0695801352186aea6f01da64ce13640ac254f7496

Download Submit
C:\Windows\{13401A38-B22A-403d-89E1-C262E41F15DC}.exe

Filesize
98KB

MD5
924c68ee0a01733300e6b6fe3df0c339

SHA1
2ee01286fbcd0a7b835d7b55139b13adf5d362d7

SHA256
a3ed98b67c7b8363bb8b69345cf239b6fadb632005016b83c571f560fddfbe40

SHA512
6ddd1496c125360df30ef1c5e53a1f2022a4a5293173f8c706c6919bfa965ce42025a508b3c89918c0b99db1d858a1da30221df0023e9ac093c31877f3b17b4c

Download Submit
C:\Windows\{1578E384-16AF-4012-B6F9-F6B64A725464}.exe

Filesize
98KB

MD5
266e70826324462b6a04720e8489366e

SHA1
b790c96eec8b06cd42a02488a1830cb8eb350bbc

SHA256
ade408cc763114e070d51bb76968e91aa17763471eec995e27498f020e29e1c2

SHA512
e6851070ef0ef7a0e30b49341957f0b09caf4fe2bf9bde96f249fafcf799a5d034add069610c9024ed36d1fcbddcf968540dd6927a5bb085b73ba40e498a27c4

Download Submit
C:\Windows\{41998565-9C9A-46a2-A871-3DB1C88C1E20}.exe

Filesize
98KB

MD5
45631caf07a21a8b64214b9a45f53ed0

SHA1
88636b20b58e859b80b0f0624f6ae9c17b9e79e0

SHA256
9400b0688d2c6758c7b38a03b004c4961eb13ff0e20e4ec31668c1574e13a099

SHA512
75cfab35449f91234e5f1c6415afebcf9b71b5864f439339793efdab4d21bdca5e3685fa86023b150b961904e9381d8e274bc0c9803c59d0c2a7d6051b25bead

Download Submit
C:\Windows\{97A55707-C6F2-4dd7-914F-E1E60A766CA1}.exe

Filesize
98KB

MD5
39abc58441253865881e02a6faddc16f

SHA1
de2377baa7cf241aa9823943f4dbf2728453e00c

SHA256
75e5af6ec4e687a1166d02487a05cff8a9fcf7f80873541ecadb553443dafc35

SHA512
b75a34001501a9e363657be94de17bdec0b83960397b3e04a572bf5e0ab1ca1c4b69ddeb31693f0cc4cf74b9cf8e7a1ec8eec042197559f0552184bae8227418

Download Submit
C:\Windows\{9AF06D94-A593-4501-8133-AAF3AA34BD94}.exe

Filesize
98KB

MD5
09905b567c55f034fb74b930d4685463

SHA1
89c9cb3131c1773f1f98f36ae7ce94a70fb399d5

SHA256
c4bef7e83e71721af33c96458a5842a5f519f70bd80f132136e1f0217c281837

SHA512
a9a71aaf72128c23a467e4e650876740c1183a2b11bd8118e6592969e5dc8f669bc694ffeafddf2b20df8e200bd4477093674f9ee7de1ffe21d7b93ecea1440c

Download Submit
C:\Windows\{C6976D53-918D-4c75-8042-5581854B090E}.exe

Filesize
98KB

MD5
66bae2a4c9b5fe09cf64dc67061ee2c5

SHA1
92654004a9ad4a4f85833ab849ab16d96015f0b6

SHA256
a805ac9ad762ae4382578a0ee1e2abd895165200152a2422f21e5b00c837ce20

SHA512
56f38e1fcf76dd0353a1a7677767f4c63f70eb6c5030ba7ba6636338bc1405b26bbc499b4df38ae86e700ac6337d9959abf75fd5f5bac9246e92c4c7b4e1bcbc

Download Submit
C:\Windows\{CA13E2E6-F635-4aea-9343-7E1D09CD1940}.exe

Filesize
98KB

MD5
9172639e1d005c996e62ce28c0afff92

SHA1
3e3c0fe008182c7d29242e051aa484fa20f1ce61

SHA256
0a6cdc9d5fd65ebf9798ec6883d8852cd7eab2163b4f76568be8b274b1cef9e4

SHA512
995bcb511d327c34eeb4ba6918f44f994c0279c1a347bd31e33863c4da92665e4d423f0771a71ac2197d6109bfb92367d4d8e9b8373e93caad003265bfd257a5

Download Submit
C:\Windows\{D382DA45-EBDD-41ca-AB67-7A08F4E0A2E2}.exe

Filesize
98KB

MD5
9c80a939deb45e06f195a68d639fb9f1

SHA1
7826ca4a3e6e51d3e7ee79aa6ac67d70d05bf232

SHA256
0be770721d53c71679feceaf14d9728f20238546b42a4d7a71fa15376360c006

SHA512
d26a39ed2ee81df800103873aba1a4d8ae5ffb369fd8f92fa5f72d993e80be48a42636f94111e985a0a08558742eeaa6bffb7fb7361b0f1e35607cb7f8f47905

Download Submit
C:\Windows\{E452F217-C283-4488-8BBD-BEC1CD004F4B}.exe

Filesize
98KB

MD5
83e53e7c77f093d549f996ef0d381e98

SHA1
64f56f91ddd80476c3dfcb9a86a3ee1a575797c9

SHA256
caf3a79ceb83dd80e90681bc0407bcc1b9427b2502a5e39833ca0c2d704de670

SHA512
581076a571c29407b97bdb24e9f67976c94c53824862e5d9e4192dce10f7b376ab2dcb46b46cbe0d38297e563ff57a2283ab1db2b043ee0c920934224c3268d8

Download Submit
C:\Windows\{EE4FCCB1-F339-4307-948C-3205428F033C}.exe

Filesize
98KB

MD5
31bf38908fda3eabc6115126d94a319e

SHA1
eea3068697d8c4c66c2b8edd2bb0307eba660a47

SHA256
1565694535a867fbbd06fcf768e331cab3bd38cf27a8dfe5ca39306926f4e8d1

SHA512
f5990ffc780033cb90fa8b4164e5590034a369b0876a65e7ffd13183f7843254c80a9e9f57371ae5998283a4b97383fa1c17148e504db94e2bfb9734b05eacdd

Download Submit
memory/940-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/940-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1100-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1100-57-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1480-47-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1480-42-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2084-4-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2084-11-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2156-41-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2156-36-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3400-66-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3556-16-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3556-12-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3848-64-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3848-59-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4384-48-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4384-53-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4524-30-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4524-34-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4548-17-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4548-22-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/5072-23-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/5072-28-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads