Malware Analysis Report

2025-01-06 09:16

Sample ID 240601-fy2x4abg48
Target 8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe
SHA256 34e483aef77327ad2279e2f06564f832bfa2e44aaafe27b630351ad8b94a9b6d
Tags
upx evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

34e483aef77327ad2279e2f06564f832bfa2e44aaafe27b630351ad8b94a9b6d

Threat Level: Known bad

The file 8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

upx evasion persistence

Modifies firewall policy service

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 05:17

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 05:17

Reported

2024-06-01 05:20

Platform

win7-20240221-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2672 set thread context of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 set thread context of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1652 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2108 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2108 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2108 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1652 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2672 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ljWUA.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/1652-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ljWUA.bat

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

MD5 3977a004d7fa65c87759cff8e923f192
SHA1 ec06d10509b52a140a17bcb4f7532dfdbb82f004
SHA256 992633ce33762890d4feaf558d89ef4e63c694a2514c75d9149842a2f1290a01
SHA512 d3de2d08b8976c967ac15ad8971b0ab5768fd2b51750c92da3984259b0e1b907809c05e4be296267b9e4e9513c0b5e3bdbee10cbeb6ab501fdc4f802a6f520f4

memory/1652-30-0x0000000003220000-0x000000000347F000-memory.dmp

memory/1652-42-0x0000000003220000-0x000000000347F000-memory.dmp

memory/1652-43-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2408-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-63-0x00000000009C0000-0x0000000000C1F000-memory.dmp

memory/2560-64-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2560-67-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2560-74-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2672-81-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2560-78-0x0000000000990000-0x0000000000BEF000-memory.dmp

memory/2560-77-0x0000000000990000-0x0000000000BEF000-memory.dmp

memory/2560-75-0x0000000000990000-0x0000000000BEF000-memory.dmp

memory/2560-73-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2408-62-0x00000000009C0000-0x0000000000C1F000-memory.dmp

memory/2408-61-0x00000000009C0000-0x0000000000C1F000-memory.dmp

memory/2408-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2672-59-0x0000000002EE0000-0x000000000313F000-memory.dmp

memory/2408-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2560-85-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2408-86-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-87-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2560-89-0x0000000000990000-0x0000000000BEF000-memory.dmp

memory/2408-93-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-95-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-98-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-102-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-107-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2408-112-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 05:17

Reported

2024-06-01 05:20

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4656 set thread context of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 set thread context of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4160 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 4160 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 4160 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 4660 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4660 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4660 wrote to memory of 64 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4160 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4160 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4160 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4656 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 3136 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3136 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 1924 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1924 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1924 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3376 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3376 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3376 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3088 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3088 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3088 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8ee984648fe86a133e4af6529b88e560_NeikiAnalytics.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdQyh.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/4160-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kdQyh.txt

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.txt

MD5 7c2f8ef06dae545692d8c355e3ed3577
SHA1 f7917cc6c16cc3a1f23db14f2b25aac94dc31164
SHA256 7df9c8d8022d2ae293420e3a325edcfbe9d1b73ac698981a7967a699d43ba227
SHA512 a64d03d608bad4526814edca6d9aa0cceab497228503e9ddef257555f5b0ec649bba0b43f25f123edc780f5512d5e18a1a4f3b50af4664413b71a3a9eebf26e5

memory/4656-28-0x0000000000400000-0x000000000065F000-memory.dmp

memory/4160-29-0x0000000000400000-0x000000000065F000-memory.dmp

memory/3136-32-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-35-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-37-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2276-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4656-45-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2276-41-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2276-49-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3136-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2276-53-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3136-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3136-76-0x0000000000400000-0x000000000045C000-memory.dmp