Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 07:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe
- Size 91KB
- Sample240601-hwjpvaeb86
- SHA256 e414b39cd0f04e4c33e67002571d29ff6d3f983b249c54059533fe8802486ad0
- MD5 91f06becca1f76b9dbe84494b7337740
- SHA1 a6953d41318970400fbe7132337f274d0b4b3784
- SHA512 808d7c9abe999220321d57e9e7048f89802aff854f3202ecaae91294c2525d789f2e1a27c94e0ee0f8582524df85c587a4b7724698a2c15f5beca9f1c5b7d3fb
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GdAwEmBZ04faWmtN4nic+6GU:zGms4Eton0dGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 3440 xk.exe 4604 IExplorer.exe 1808 WINLOGON.EXE 4948 CSRSS.EXE 2288 SERVICES.EXE 1212 LSASS.EXE 3164 SMSS.EXE - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mig2.scr 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\shell.exe 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shell.exe 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Mig2.scr 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IExplorer.exe 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe File created C:\Windows\xk.exe 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 3440 xk.exe 4604 IExplorer.exe 1808 WINLOGON.EXE 4948 CSRSS.EXE 2288 SERVICES.EXE 1212 LSASS.EXE 3164 SMSS.EXE - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3440 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 83 PID 2660 wrote to memory of 3440 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 83 PID 2660 wrote to memory of 3440 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 83 PID 2660 wrote to memory of 4604 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 84 PID 2660 wrote to memory of 4604 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 84 PID 2660 wrote to memory of 4604 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 84 PID 2660 wrote to memory of 1808 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 85 PID 2660 wrote to memory of 1808 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 85 PID 2660 wrote to memory of 1808 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 85 PID 2660 wrote to memory of 4948 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 86 PID 2660 wrote to memory of 4948 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 86 PID 2660 wrote to memory of 4948 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 86 PID 2660 wrote to memory of 2288 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 87 PID 2660 wrote to memory of 2288 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 87 PID 2660 wrote to memory of 2288 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 87 PID 2660 wrote to memory of 1212 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 88 PID 2660 wrote to memory of 1212 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 88 PID 2660 wrote to memory of 1212 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 88 PID 2660 wrote to memory of 3164 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 89 PID 2660 wrote to memory of 3164 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 89 PID 2660 wrote to memory of 3164 2660 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe 89 - System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\91f06becca1f76b9dbe84494b7337740_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2660 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3440
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1808
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4948
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3164
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 91KB
- SHA256 0898b94d3b265a5b166ec39f8cf3cecd9b784be47a48b863686a2c18c4a3d767
- MD5 045977715a997f652740c8920028afed
- SHA1 61f3cec73c4fab64af08cd21a9d99856814aa29b
- SHA512 6df041c2001f8d493eed8e84367bff29401eda209483a16836fe9cfb42f7cdfc240bd5cfa8c21558edd4546d1e76f110215b46a33d0c29497a93686f99224085
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GdAwEmBZ04faWmtN4nic+6GU:zGms4Eton0dGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 91KB
- SHA256 00a1c16cb6be775075011616038b947bcdf61c767bcc3110e074ba961c042a25
- MD5 f2bd4c31eb3b4bb53942b201219ce7e9
- SHA1 227f04a1e5a20168daf232cd31b1c8f9c9b6158b
- SHA512 a4a7f912440860f180cd60d11d4ac78d2376b2f2457b81d9ca1432097db399942807389a8854b2422ad4ca17ff413416364afc9495ee73db7b048cd565496ad7
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GQAwEmBZ04faWmtN4nic+6GU:zGms4Eton0QGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 91KB
- SHA256 a7ff2fc52e244d997a02b7fa4f241b9937716599809826b6139121c044bc0c8c
- MD5 02a43c2f2bb935a659d1e76c175698fa
- SHA1 7ec5b93dc78524fd7729cd53a292f828ad2cc58f
- SHA512 1bbc00ae953dffe3d555ce8658332ef8c2f514aadabee4f0606a6cdf7b7b8760a7ca36fd859c6946407587df11d53782c8fb97fab050bd4253b98bd7856291fd
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GDAwEmBZ04faWmtN4nic+6GU:zGms4Eton0DGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 91KB
- SHA256 3aed1e97b15db2043478a3c183cad7f6899074a7991524bce3a227635f9a7701
- MD5 5077d96d4445cfbd1325c79744548353
- SHA1 cb75922262a0cc988c9f37bf3960377f5af7df70
- SHA512 202fa32bd0b3dd00b918ec3a0f7cf28f10bf792ffa0f22b7fcf873cecda3a207bacdca8c16620cf90e905d00dc26c30298ab15242ccc3830a79f23e44dd06c66
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GmAwEmBZ04faWmtN4nic+6GU:zGms4Eton0mGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\winlogon.exe
- Size 91KB
- SHA256 e414b39cd0f04e4c33e67002571d29ff6d3f983b249c54059533fe8802486ad0
- MD5 91f06becca1f76b9dbe84494b7337740
- SHA1 a6953d41318970400fbe7132337f274d0b4b3784
- SHA512 808d7c9abe999220321d57e9e7048f89802aff854f3202ecaae91294c2525d789f2e1a27c94e0ee0f8582524df85c587a4b7724698a2c15f5beca9f1c5b7d3fb
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GdAwEmBZ04faWmtN4nic+6GU:zGms4Eton0dGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 91KB
- SHA256 f887913dc9204fd081fb39ece1e1abb304771ac071cc49e1f6890d721b6714dc
- MD5 9dcca51aaf9fb86617fff6dbd92b90aa
- SHA1 18f372622fd83bbc7e7aa4fe9bb4f1ad6d5f5a08
- SHA512 5d55d52d121fb55993d7af3744e1c3ed1ad5e39e99ba7bdae26deb5854eea893a22dbe03c281e782a679044b86affd395276b7f62d1e6fce5d7b270493cceb76
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GxAwEmBZ04faWmtN4nic+6GU:zGms4Eton0xGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 91KB
- SHA256 8a10297225315e223688165d89ed7beff35660a9a986fa143b167aec194ce908
- MD5 c92be6770f05a33744f12417da13c7e9
- SHA1 b3c7a590dfce5595c959dec4541ba94ab2fc577e
- SHA512 4f73cc64ee5a2f6fa5bb7c54d9fff12264916650b7f6a8915608fe7436938ff275861b73cd1648de2f7c94e31b1405327746da4d80dbc83c4246e755d89c2b47
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GLAwEmBZ04faWmtN4nic+6GU:zGms4Eton0LGms4Eton0U
- MD5 SHA1 SHA512 SSDEEP