Analysis
- max time kernel
93s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c3fa1cd0231cb4df617426e1d103410_NeikiAnalytics.dll
Resource
win7-20240215-en
windows7-x64
15 signatures
150 seconds
General
- Target 3c3fa1cd0231cb4df617426e1d103410_NeikiAnalytics.dll
- Size 120KB
- Sample240601-n6mgdacf28
- SHA256 737c5a35c19323ce7cd15b8137fb5af16aeccc92c2aa010f05f877804c9d5562
- MD5 3c3fa1cd0231cb4df617426e1d103410
- SHA1 549d4d512d8051f6324020c4cd077917f766781b
- SHA512 4bceda49d74c83035b723ec1e3eaa7c05d7ad6bb4d12f0c6105ac87c3043d6d2443f6868687cf67c496474588f66cceb0d4b3d1bdf7c8e43c5a6988251e15fae
- SSDEEP 3072:DtTluuz7hYG6r+yky3IaHyDJnMrMFQfR:DiuxZ6r+Py3FoJnJg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57828e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57828e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57828e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57828e.exe - Executes dropped EXE 3 IoCs
pid Process 1456 e5766d8.exe 3984 e5767b3.exe 4636 e57828e.exe -
resource yara_rule behavioral2/memory/1456-6-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-13-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-26-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-27-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-33-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-34-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-42-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-43-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-52-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-54-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-55-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-67-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-69-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-71-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-73-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-74-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-76-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-78-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-81-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-83-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-88-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1456-84-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4636-120-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4636-152-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57828e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5766d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57828e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57828e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57828e.exe - Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: e5766d8.exe File opened (read-only) \??\E: e5766d8.exe File opened (read-only) \??\H: e5766d8.exe File opened (read-only) \??\J: e5766d8.exe File opened (read-only) \??\K: e5766d8.exe File opened (read-only) \??\L: e5766d8.exe File opened (read-only) \??\G: e57828e.exe File opened (read-only) \??\I: e5766d8.exe File opened (read-only) \??\M: e5766d8.exe File opened (read-only) \??\Q: e5766d8.exe File opened (read-only) \??\T: e5766d8.exe File opened (read-only) \??\E: e57828e.exe File opened (read-only) \??\G: e5766d8.exe File opened (read-only) \??\N: e5766d8.exe File opened (read-only) \??\O: e5766d8.exe File opened (read-only) \??\S: e5766d8.exe File opened (read-only) \??\P: e5766d8.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e5766d8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5766d8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5766d8.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5766d8.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e576726 e5766d8.exe File opened for modification C:\Windows\SYSTEM.INI e5766d8.exe File created C:\Windows\e57b72a e57828e.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1456 e5766d8.exe 1456 e5766d8.exe 1456 e5766d8.exe 1456 e5766d8.exe 4636 e57828e.exe 4636 e57828e.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe Token: SeDebugPrivilege 1456 e5766d8.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4360 wrote to memory of 2392 4360 rundll32.exe 84 PID 4360 wrote to memory of 2392 4360 rundll32.exe 84 PID 4360 wrote to memory of 2392 4360 rundll32.exe 84 PID 2392 wrote to memory of 1456 2392 rundll32.exe 85 PID 2392 wrote to memory of 1456 2392 rundll32.exe 85 PID 2392 wrote to memory of 1456 2392 rundll32.exe 85 PID 1456 wrote to memory of 800 1456 e5766d8.exe 9 PID 1456 wrote to memory of 808 1456 e5766d8.exe 10 PID 1456 wrote to memory of 380 1456 e5766d8.exe 13 PID 1456 wrote to memory of 2456 1456 e5766d8.exe 42 PID 1456 wrote to memory of 2484 1456 e5766d8.exe 43 PID 1456 wrote to memory of 2736 1456 e5766d8.exe 48 PID 1456 wrote to memory of 3488 1456 e5766d8.exe 56 PID 1456 wrote to memory of 3672 1456 e5766d8.exe 57 PID 1456 wrote to memory of 3860 1456 e5766d8.exe 58 PID 1456 wrote to memory of 3948 1456 e5766d8.exe 59 PID 1456 wrote to memory of 4016 1456 e5766d8.exe 60 PID 1456 wrote to memory of 768 1456 e5766d8.exe 61 PID 1456 wrote to memory of 788 1456 e5766d8.exe 62 PID 1456 wrote to memory of 4496 1456 e5766d8.exe 74 PID 1456 wrote to memory of 4944 1456 e5766d8.exe 75 PID 1456 wrote to memory of 2536 1456 e5766d8.exe 82 PID 1456 wrote to memory of 4360 1456 e5766d8.exe 83 PID 1456 wrote to memory of 2392 1456 e5766d8.exe 84 PID 1456 wrote to memory of 2392 1456 e5766d8.exe 84 PID 2392 wrote to memory of 3984 2392 rundll32.exe 86 PID 2392 wrote to memory of 3984 2392 rundll32.exe 86 PID 2392 wrote to memory of 3984 2392 rundll32.exe 86 PID 2392 wrote to memory of 4636 2392 rundll32.exe 94 PID 2392 wrote to memory of 4636 2392 rundll32.exe 94 PID 2392 wrote to memory of 4636 2392 rundll32.exe 94 PID 1456 wrote to memory of 800 1456 e5766d8.exe 9 PID 1456 wrote to memory of 808 1456 e5766d8.exe 10 PID 1456 wrote to memory of 380 1456 e5766d8.exe 13 PID 1456 wrote to memory of 2456 1456 e5766d8.exe 42 PID 1456 wrote to memory of 2484 1456 e5766d8.exe 43 PID 1456 wrote to memory of 2736 1456 e5766d8.exe 48 PID 1456 wrote to memory of 3488 1456 e5766d8.exe 56 PID 1456 wrote to memory of 3672 1456 e5766d8.exe 57 PID 1456 wrote to memory of 3860 1456 e5766d8.exe 58 PID 1456 wrote to memory of 3948 1456 e5766d8.exe 59 PID 1456 wrote to memory of 4016 1456 e5766d8.exe 60 PID 1456 wrote to memory of 768 1456 e5766d8.exe 61 PID 1456 wrote to memory of 788 1456 e5766d8.exe 62 PID 1456 wrote to memory of 4496 1456 e5766d8.exe 74 PID 1456 wrote to memory of 4944 1456 e5766d8.exe 75 PID 1456 wrote to memory of 3984 1456 e5766d8.exe 86 PID 1456 wrote to memory of 3984 1456 e5766d8.exe 86 PID 1456 wrote to memory of 4868 1456 e5766d8.exe 88 PID 1456 wrote to memory of 4968 1456 e5766d8.exe 89 PID 1456 wrote to memory of 4636 1456 e5766d8.exe 94 PID 1456 wrote to memory of 4636 1456 e5766d8.exe 94 PID 4636 wrote to memory of 800 4636 e57828e.exe 9 PID 4636 wrote to memory of 808 4636 e57828e.exe 10 PID 4636 wrote to memory of 380 4636 e57828e.exe 13 PID 4636 wrote to memory of 2456 4636 e57828e.exe 42 PID 4636 wrote to memory of 2484 4636 e57828e.exe 43 PID 4636 wrote to memory of 2736 4636 e57828e.exe 48 PID 4636 wrote to memory of 3488 4636 e57828e.exe 56 PID 4636 wrote to memory of 3672 4636 e57828e.exe 57 PID 4636 wrote to memory of 3860 4636 e57828e.exe 58 PID 4636 wrote to memory of 3948 4636 e57828e.exe 59 PID 4636 wrote to memory of 4016 4636 e57828e.exe 60 PID 4636 wrote to memory of 768 4636 e57828e.exe 61 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5766d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57828e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2484
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2736
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c3fa1cd0231cb4df617426e1d103410_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3c3fa1cd0231cb4df617426e1d103410_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\e5766d8.exeC:\Users\Admin\AppData\Local\Temp\e5766d8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\e5767b3.exeC:\Users\Admin\AppData\Local\Temp\e5767b3.exe4⤵
- Executes dropped EXE
PID:3984
-
-
C:\Users\Admin\AppData\Local\Temp\e57828e.exeC:\Users\Admin\AppData\Local\Temp\e57828e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4636
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3672
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3860
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:768
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:788
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4496
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4944
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2536
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5766d8.exe
- Size 97KB
- SHA256 8e2731bc9807e5816e69f0c75021449c266c1bc5bacdf3470dcf98b79362e2dc
- MD5 3aeeb570d7310c867ca0c0b6ea69c72b
- SHA1 56049fea3a6508c01b5a382dae76ff4a50ead69f
- SHA512 9e202bde7c5c27a443d77a4338ccbdff7bcbb5f7a82c52f487310a96fbce1749b0af8283d3d193d026dcbeba6ec33b0e96a04b94801158a45d0c01953d53d5be
- SSDEEP 1536:qN1P7u1DfjhSUNzqmrJCRnja3JkVn7/YgUYNiLxvTgEhfoy34YIziegPD6OS5:kdOvhrRURnja5MUii9bJJ4YHP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 a72c330df0719e3ddb5d54c25ec92fd9dead4ea9941d1106c8511c3ff153a0e7
- MD5 fba4a94e5e3e9b924b40635b5f271f27
- SHA1 82cb9c17af8799b1b75b07ca47a9f6b94c129a31
- SHA512 4b12b8624454715c2cd30f4ace97a884bb4e13d86ba690c5656b05060df0d379d45dacabd66dcd8835a05687eee9bf0a7440e81624afc215a2a8ec6410fe8378
- MD5 SHA1 SHA512