820ae773a1beb9808c33fc55677e7afe0cccb014a41634c5fa696a9ced20fc9d

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Size 159KB
Sample240601-de1vksfd91
SHA256 820ae773a1beb9808c33fc55677e7afe0cccb014a41634c5fa696a9ced20fc9d
MD5 8acfc2d8c2af6c5ce5c40c86b660eda0
SHA1 f3ba8e18130560ff6fc2baa82a2dcb6f29e5fa8c
SHA512 87a2744c96083579dc23649748285e9bfb46134a482b4412689eaf4c03efc4219a90b7eb5f9da85b34ab8197eda0fb7cf25512287e852cfae89920f46f7c240e
SSDEEP 3072:E/5F/E7tEf0i+pItYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+WWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
2716	xk.exe
2832	IExplorer.exe
4240	WINLOGON.EXE
1488	CSRSS.EXE
1924	SERVICES.EXE
4768	LSASS.EXE
208	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File created	C:\desktop.ini	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened for modification	F:\desktop.ini	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File created	F:\desktop.ini	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\W:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\X:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\H:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\V:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\B:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\L:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\I:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\J:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\M:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\P:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\R:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\E:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\G:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\T:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\U:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\K:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened (read-only)	\??\O:	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
2716	xk.exe
2832	IExplorer.exe
4240	WINLOGON.EXE
1488	CSRSS.EXE
1924	SERVICES.EXE
4768	LSASS.EXE
208	SMSS.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2716	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	86
PID 1492 wrote to memory of 2716	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	86
PID 1492 wrote to memory of 2716	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	86
PID 1492 wrote to memory of 2832	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	87
PID 1492 wrote to memory of 2832	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	87
PID 1492 wrote to memory of 2832	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	87
PID 1492 wrote to memory of 4240	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	88
PID 1492 wrote to memory of 4240	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	88
PID 1492 wrote to memory of 4240	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	88
PID 1492 wrote to memory of 1488	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	89
PID 1492 wrote to memory of 1488	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	89
PID 1492 wrote to memory of 1488	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	89
PID 1492 wrote to memory of 1924	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	90
PID 1492 wrote to memory of 1924	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	90
PID 1492 wrote to memory of 1924	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	90
PID 1492 wrote to memory of 4768	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	92
PID 1492 wrote to memory of 4768	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	92
PID 1492 wrote to memory of 4768	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	92
PID 1492 wrote to memory of 208	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	93
PID 1492 wrote to memory of 208	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	93
PID 1492 wrote to memory of 208	1492	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe	93

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8acfc2d8c2af6c5ce5c40c86b660eda0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1492
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2716
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2832
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4240
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1488
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1924
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4768
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 159KB
SHA256 528755993f083dbd75b3005eb0697427e632f5f989ba527fa5683ef8e620e406
MD5 5877a41b9e3d1124e39c9c39b091afd9
SHA1 0a20b25ca33934387b9363f9bc5bb8b4c89ee50b
SHA512 057577c822000be7086d1001de50cf258485014c0159f038d2ea86006d51e4bfe15f92ad895685c24423941e702099a63d77016596f8b8e89908819e80946db9
SSDEEP 3072:E/5F/E7tEf0i+pctYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+eWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 159KB
SHA256 687aa4312af3e26ec8e4f67a50760c37b8b64f5d0bc0403879d3c991470ae7c7
MD5 51d4854f6dfa0d4ea159ad6bfb97b7b0
SHA1 4798569257db090be59c8088e667bd55a63f1394
SHA512 f2539bd4e52bb907215148cf24723bdb0b93dc043a3e29ac1ac345dc467cd09a31622c6b00ea8a41f48b46792cdfbdb8cf3f5a97ff243f8d3a0d8e39d0046bf9
SSDEEP 3072:E/5F/E7tEf0i+p1tYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+/WJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 159KB
SHA256 c7dfeb78eeaa871eb94c8e883c6c68d9bcf8ae5824d2ee1194c467ac7da21192
MD5 17bc23d1aa412b31d7d24b365751bb88
SHA1 80a2a7203a196039256deab0bb924383a452ac29
SHA512 870afeaf4516c7e9efbb1fef835aabb84344364251d93077f05c97b2958013b4fbee3d4d11fb61a21c9e8c70b38818f8cd500e331f6ad890c0573c9289d6a646
SSDEEP 3072:E/5F/E7tEf0i+pwtYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+aWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 159KB
SHA256 862eeecaabb1b79f33fcc334048f307862d5321139941570fc6ebad3c6fbc555
MD5 709172520fe633c546f9cacdbea35e72
SHA1 f545a70d13fb68d70974321d69c4f28e78b58775
SHA512 78b332de980160566ed576d6d0519fe80ee7bb20e0022443b14a70171701d3cb558e0a71dbd3a2b8b09c0d714ecdb97db0cc8ee3d153713ff8d69cbe29f44f67
SSDEEP 3072:E/5F/E7tEf0i+pCtYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+sWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Size 159KB
SHA256 d37ef3c5060a8d5250beab92f3e6e0bdc9a30c3c037009358e70be9011196e67
MD5 2c8feca58684e76a449f4a115dfa6fe6
SHA1 b117a16ec0f869ce1519570de44d214153f1e108
SHA512 f49993912bd4776adf927d171673e2563603f08e8cda7943f15eb1efc33c156aa686ab94d2e703b13af4dfcd07d9f5d4543963e38f8979b889f254d72abd8860
SSDEEP 3072:E/5F/E7tEf0i+pStYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+kWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 159KB
SHA256 bdfc0996a4f3164388ec55c2ead9c3603575ef165a4184b03dc4c9e61cc17c1b
MD5 5ddf6b49ab8cb7145fdc6951a1663bb8
SHA1 9df7fc58ae62b8c8509a75bb202274f078901f2d
SHA512 bcf168d210af9356629b457e6bb2815331e3d2e00c48fcbcfebe148c48c35910c51d14a1a9ec87df8842e9d1dc3447b4e132ced790b7309c4abe5439d778e9bd
SSDEEP 3072:E/5F/E7tEf0i+pBtYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+TWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 159KB
SHA256 820ae773a1beb9808c33fc55677e7afe0cccb014a41634c5fa696a9ced20fc9d
MD5 8acfc2d8c2af6c5ce5c40c86b660eda0
SHA1 f3ba8e18130560ff6fc2baa82a2dcb6f29e5fa8c
SHA512 87a2744c96083579dc23649748285e9bfb46134a482b4412689eaf4c03efc4219a90b7eb5f9da85b34ab8197eda0fb7cf25512287e852cfae89920f46f7c240e
SSDEEP 3072:E/5F/E7tEf0i+pItYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+WWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 159KB
SHA256 11ff5f1b7870336c53fee2b95962500863c6f0c3ec95aa4c30953fccd7ff09f8
MD5 0feda885032b63a6d70d5923780b3668
SHA1 a8c42a91dfe733090fb6098ca0f9d3867c74883d
SHA512 1c0d66e32b022ec44b18944b7f2ed0dc13e82b3ee674b9417c9feb44eaead6dd6c1f47729c35b88f165ec3a1d96ddc82621facd9dfd536eced0c83829b1df24a
SSDEEP 3072:E/5F/E7tEf0i+pctYlpJH7iXQNgggHlxDZiYLK5WpYn:EhF4cH+eWJH7igNgjdFKsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Folder.htt

Path C:\XK\Folder.htt
Size 640B
SHA256 fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
MD5 5d142e7978321fde49abd9a068b64d97
SHA1 70020fcf7f3d6dafb6c8cd7a55395196a487bef4
SHA512 2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\desktop.ini
Size 217B
SHA256 52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e
MD5 c00d8433fe598abff197e690231531e0
SHA1 4f6b87a4327ff5343e9e87275d505b9f145a7e42
SHA512 a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1
MD5 SHA1 SHA512

Submit Download

memory/208-94-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/208-90-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1488-69-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1488-73-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1492-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1492-120-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1924-76-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1924-80-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2716-52-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2716-48-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2832-56-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2832-59-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4240-70-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4240-65-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4768-87-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4768-86-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads