caea8fc754e1074fff24d9b54a6f54654ea046576d730bca1ed2cba1694821af

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Size

91KB
MD5

148ac21619ee9d498a92bf64d21570d0
SHA1

4df8ea43c4647b0509a61dbec04a54796b298a92
SHA256

caea8fc754e1074fff24d9b54a6f54654ea046576d730bca1ed2cba1694821af
SHA512

0a4b2831b646fc44f4a8933d4355ca1a3fbb5e6d98b8d29c7fd62376bf5e6514917e256cc287695a669a28c8678e2679119f25857878bf608b82fa116eaf7206
SSDEEP

1536:ERsjdf1aM67v32Z9x5nouy8VT9Rsjdf1aM67v32Z9x5nouy8VTU:EOaHv3YpoutN9OaHv3YpoutNU

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1804	xk.exe
2792	IExplorer.exe
616	WINLOGON.EXE
392	CSRSS.EXE
1880	SERVICES.EXE
768	LSASS.EXE
1228	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1644-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000015f54-8.dat	upx
behavioral1/files/0x0008000000016d1a-108.dat	upx
behavioral1/memory/1804-113-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1804-116-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d33-115.dat	upx
behavioral1/memory/1644-123-0x00000000024A0000-0x00000000024CF000-memory.dmp	upx
behavioral1/memory/2792-124-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2792-130-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d44-131.dat	upx
behavioral1/memory/616-140-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/616-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d4c-141.dat	upx
behavioral1/memory/392-148-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d55-155.dat	upx
behavioral1/memory/392-154-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1880-164-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000016d68-165.dat	upx
behavioral1/memory/1644-171-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/768-178-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1228-187-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1644-189-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
1804	xk.exe
2792	IExplorer.exe
616	WINLOGON.EXE
392	CSRSS.EXE
1880	SERVICES.EXE
768	LSASS.EXE
1228	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1804	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 1804	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 1804	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 1804	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 2792	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 2792	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 2792	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 2792	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	29
PID 1644 wrote to memory of 616	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 616	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 616	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 616	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	30
PID 1644 wrote to memory of 392	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 392	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 392	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 392	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	31
PID 1644 wrote to memory of 1880	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 1880	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 1880	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 1880	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	32
PID 1644 wrote to memory of 768	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 768	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 768	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 768	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	33
PID 1644 wrote to memory of 1228	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	34
PID 1644 wrote to memory of 1228	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	34
PID 1644 wrote to memory of 1228	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	34
PID 1644 wrote to memory of 1228	1644	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\148ac21619ee9d498a92bf64d21570d0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1644
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1804
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2792
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:616
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:392
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1880
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:768
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\services.exe

Filesize
91KB

MD5
148ac21619ee9d498a92bf64d21570d0

SHA1
4df8ea43c4647b0509a61dbec04a54796b298a92

SHA256
caea8fc754e1074fff24d9b54a6f54654ea046576d730bca1ed2cba1694821af

SHA512
0a4b2831b646fc44f4a8933d4355ca1a3fbb5e6d98b8d29c7fd62376bf5e6514917e256cc287695a669a28c8678e2679119f25857878bf608b82fa116eaf7206

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
05cb217ab1e1c1a8b5418284e214bca9

SHA1
2bf4972b487bc10bbfeaba39dbd5db7d1e6c204d

SHA256
3f208a499e251fa75078d4f88228081465c8cba8d91524b4bc94d108979ad13d

SHA512
674cd8ce1be8d1e4b25a1cf90d99647877a34f6ebdee8c6490ab07b05be31f4631b3a8c430ae7a10065b4be1055407313131f16c68aa93f8b79366f0c90d5d84

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
fba60af7cb8fc8f4303481dc9cb30de8

SHA1
ff39d2a91d9a66f847e41687dd3702fc7b5d387f

SHA256
bfd70d926130b22962ec0eef0508057077e5156631c0706a4646f38e9ed590af

SHA512
482717df35d718197bd2e17182eef179b97cd62883cf53d44e42058579b2c2b22a758bed67776d5c9075ee27f567c8873d349ac905b266c8e9f1db13461d08ac

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
6f785a6ab67f087de7176b4b08126d80

SHA1
b6a21065d202ea060ec068a55cae9691fee0c037

SHA256
f23d53fb24b886efaae11a926626a65ab69ae972b4bc61667ba65ab1ccadd720

SHA512
d603f6b8b76446069902b091a57ea7b65028c652c52fdc0a5891b4e1302fb1e27588127319feb9d28cbf384d46fb182b6d1b33dbd1cbd5cc2b0ebe89636c9a98

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
49896ba7835ff73a25417eea685c12b7

SHA1
77634ebccd0973189b49c1de34a5d6d1dcee3029

SHA256
17719aa7127a4cc96ef20ef783f95a249ba2a142f9ad2c6ee523bf5bb1edc544

SHA512
8cc1d339352b1f9caf8e90f82be3fe78eba63c1bcc35caf3652f158460f9b75311249682a28db6d7b94db8f626fdb285464133d102f81caf10119e27ee6572f6

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
058381deaef2ba4c2d1c06b947eb14b8

SHA1
9de8f7e7bf7f5ef3df504ceda8b95832377f5250

SHA256
d29785d918221a024ffc2c688a493f9f3fcf97710e3ad1b2e815cbb51619a30c

SHA512
d144df4188d976252131863f9aa0cd5db51f949108f484f22fab8db58b2e19ee5785ed996fbf6fe025a73a9a331d9442fad707b9b4be29f75499c7f3ba0a373d

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
614c77e13d759a46e0e06380506425e9

SHA1
afdbab7dffd8670e2c019cd3451898c8d0d87fa0

SHA256
c2fb9e1853095ae1e1af2b6ab4306182ac3a4ae33dca9594f29eb360217b9be3

SHA512
a8d4bdc0549cfc08fa85c9b2790e4b4715829fdc4b586e0cec7f62ada72b7af8645092873aca966ef0c67ba47b38d4c8febba8fdfb398d8dd1de91462b296ac9

Download Submit
memory/392-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/392-154-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/616-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/616-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/768-178-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1228-187-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-160-0x00000000024A0000-0x00000000024CF000-memory.dmp

Filesize
188KB

Download
memory/1644-123-0x00000000024A0000-0x00000000024CF000-memory.dmp

Filesize
188KB

Download
memory/1644-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-161-0x00000000024A0000-0x00000000024CF000-memory.dmp

Filesize
188KB

Download
memory/1644-111-0x00000000024A0000-0x00000000024CF000-memory.dmp

Filesize
188KB

Download
memory/1644-171-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-110-0x00000000024A0000-0x00000000024CF000-memory.dmp

Filesize
188KB

Download
memory/1644-189-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1804-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1804-113-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1880-164-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2792-130-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2792-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download