1c1fec027915cf5522b246751440a09acca048b17d22c436d6e4792608a64150

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe
Size 98KB
Sample240603-bkkpfafb86
SHA256 1c1fec027915cf5522b246751440a09acca048b17d22c436d6e4792608a64150
MD5 93d6eb52cd922153610a6b6e10545e60
SHA1 093936d0d1f46203a6d04903247b3f18d297a0a3
SHA512 b3195cdfd2c6e086a84845d6af69f4b177e3286de94d0fad07b7546c1ef6c3be57a7a3ed54ddd2153ce43f3c77666501a3c999d2ba1b01bcbc5b2d3657f9445a
SSDEEP 768:5vw9816thKQLroR4/wQkNrfrunMxVFA3b7glws:lEG/0oRlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F39207E1-649C-486f-BBCE-972B821CB901}	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49869DD4-D553-4064-AFD5-E9CB6166F071}	{F39207E1-649C-486f-BBCE-972B821CB901}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6ABC831-B759-442b-93C0-2E47CDD999F0}	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6ABC831-B759-442b-93C0-2E47CDD999F0}\stubpath = "C:\\Windows\\{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe"	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A891FA9-6860-41ce-934D-535BCD1972B7}	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AACF76C-9DCF-4532-8FC1-59602075C094}	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49869DD4-D553-4064-AFD5-E9CB6166F071}\stubpath = "C:\\Windows\\{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe"	{F39207E1-649C-486f-BBCE-972B821CB901}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F39207E1-649C-486f-BBCE-972B821CB901}\stubpath = "C:\\Windows\\{F39207E1-649C-486f-BBCE-972B821CB901}.exe"	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB343031-4B96-405d-86AB-973B5ED6533F}	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A891FA9-6860-41ce-934D-535BCD1972B7}\stubpath = "C:\\Windows\\{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe"	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D732F907-6668-4462-999B-141757F17AA8}\stubpath = "C:\\Windows\\{D732F907-6668-4462-999B-141757F17AA8}.exe"	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}\stubpath = "C:\\Windows\\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe"	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AACF76C-9DCF-4532-8FC1-59602075C094}\stubpath = "C:\\Windows\\{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe"	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFBED565-B163-4e33-A081-0EADC483D09C}	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFBED565-B163-4e33-A081-0EADC483D09C}\stubpath = "C:\\Windows\\{AFBED565-B163-4e33-A081-0EADC483D09C}.exe"	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB343031-4B96-405d-86AB-973B5ED6533F}\stubpath = "C:\\Windows\\{DB343031-4B96-405d-86AB-973B5ED6533F}.exe"	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}\stubpath = "C:\\Windows\\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe"	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}\stubpath = "C:\\Windows\\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe"	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D732F907-6668-4462-999B-141757F17AA8}	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe

Executes dropped EXE 11 IoCs

pid	Process
4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe
4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
2428	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe
4916	{D732F907-6668-4462-999B-141757F17AA8}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
File created	C:\Windows\{F39207E1-649C-486f-BBCE-972B821CB901}.exe	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
File created	C:\Windows\{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	{F39207E1-649C-486f-BBCE-972B821CB901}.exe
File created	C:\Windows\{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
File created	C:\Windows\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
File created	C:\Windows\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe
File created	C:\Windows\{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
File created	C:\Windows\{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
File created	C:\Windows\{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
File created	C:\Windows\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
File created	C:\Windows\{D732F907-6668-4462-999B-141757F17AA8}.exe	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
Token: SeIncBasePriorityPrivilege	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
Token: SeIncBasePriorityPrivilege	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
Token: SeIncBasePriorityPrivilege	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe
Token: SeIncBasePriorityPrivilege	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
Token: SeIncBasePriorityPrivilege	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
Token: SeIncBasePriorityPrivilege	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
Token: SeIncBasePriorityPrivilege	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
Token: SeIncBasePriorityPrivilege	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
Token: SeIncBasePriorityPrivilege	2428	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4728	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe	91
PID 3552 wrote to memory of 4728	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe	91
PID 3552 wrote to memory of 4728	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe	91
PID 3552 wrote to memory of 3776	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe	92
PID 3552 wrote to memory of 3776	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe	92
PID 3552 wrote to memory of 3776	3552	93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe	92
PID 4728 wrote to memory of 4432	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	93
PID 4728 wrote to memory of 4432	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	93
PID 4728 wrote to memory of 4432	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	93
PID 4728 wrote to memory of 1560	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	94
PID 4728 wrote to memory of 1560	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	94
PID 4728 wrote to memory of 1560	4728	{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe	94
PID 4432 wrote to memory of 2852	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	96
PID 4432 wrote to memory of 2852	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	96
PID 4432 wrote to memory of 2852	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	96
PID 4432 wrote to memory of 5044	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	97
PID 4432 wrote to memory of 5044	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	97
PID 4432 wrote to memory of 5044	4432	{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe	97
PID 2852 wrote to memory of 4980	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	98
PID 2852 wrote to memory of 4980	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	98
PID 2852 wrote to memory of 4980	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	98
PID 2852 wrote to memory of 908	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	99
PID 2852 wrote to memory of 908	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	99
PID 2852 wrote to memory of 908	2852	{AFBED565-B163-4e33-A081-0EADC483D09C}.exe	99
PID 4980 wrote to memory of 4596	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe	100
PID 4980 wrote to memory of 4596	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe	100
PID 4980 wrote to memory of 4596	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe	100
PID 4980 wrote to memory of 1924	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe	101
PID 4980 wrote to memory of 1924	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe	101
PID 4980 wrote to memory of 1924	4980	{F39207E1-649C-486f-BBCE-972B821CB901}.exe	101
PID 4596 wrote to memory of 2752	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	102
PID 4596 wrote to memory of 2752	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	102
PID 4596 wrote to memory of 2752	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	102
PID 4596 wrote to memory of 2572	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	103
PID 4596 wrote to memory of 2572	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	103
PID 4596 wrote to memory of 2572	4596	{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe	103
PID 2752 wrote to memory of 540	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	104
PID 2752 wrote to memory of 540	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	104
PID 2752 wrote to memory of 540	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	104
PID 2752 wrote to memory of 1708	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	105
PID 2752 wrote to memory of 1708	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	105
PID 2752 wrote to memory of 1708	2752	{DB343031-4B96-405d-86AB-973B5ED6533F}.exe	105
PID 540 wrote to memory of 4020	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	106
PID 540 wrote to memory of 4020	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	106
PID 540 wrote to memory of 4020	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	106
PID 540 wrote to memory of 5100	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	107
PID 540 wrote to memory of 5100	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	107
PID 540 wrote to memory of 5100	540	{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe	107
PID 4020 wrote to memory of 4212	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	108
PID 4020 wrote to memory of 4212	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	108
PID 4020 wrote to memory of 4212	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	108
PID 4020 wrote to memory of 632	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	109
PID 4020 wrote to memory of 632	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	109
PID 4020 wrote to memory of 632	4020	{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe	109
PID 4212 wrote to memory of 2428	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	110
PID 4212 wrote to memory of 2428	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	110
PID 4212 wrote to memory of 2428	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	110
PID 4212 wrote to memory of 4372	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	111
PID 4212 wrote to memory of 4372	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	111
PID 4212 wrote to memory of 4372	4212	{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe	111
PID 2428 wrote to memory of 4916	2428	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe	112
PID 2428 wrote to memory of 4916	2428	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe	112
PID 2428 wrote to memory of 4916	2428	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe	112
PID 2428 wrote to memory of 3584	2428	{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe	113

C:\Users\Admin\AppData\Local\Temp\93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\93d6eb52cd922153610a6b6e10545e60_NeikiAnalytics.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
  C:\Windows\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
    C:\Windows\{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
      C:\Windows\{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\{F39207E1-649C-486f-BBCE-972B821CB901}.exe
        
        C:\Windows\{F39207E1-649C-486f-BBCE-972B821CB901}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4980
      - C:\Windows\{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
        
        C:\Windows\{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
        
        C:\Windows\{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
        
        C:\Windows\{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
        
        C:\Windows\{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
        
        C:\Windows\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe
        
        C:\Windows\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\{D732F907-6668-4462-999B-141757F17AA8}.exe
        
        C:\Windows\{D732F907-6668-4462-999B-141757F17AA8}.exe
        12⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\{FA0A322B-B096-4b0f-8A32-3423C123885E}.exe
        
        C:\Windows\{FA0A322B-B096-4b0f-8A32-3423C123885E}.exe
        13⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D732F~1.EXE > nul
        13⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{959BF~1.EXE > nul
        12⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96E7C~1.EXE > nul
        11⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A891~1.EXE > nul
        10⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A6ABC~1.EXE > nul
        9⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DB343~1.EXE > nul
        8⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{49869~1.EXE > nul
        7⤵
        
        PID:2572
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F3920~1.EXE > nul
        6⤵
        
        PID:1924
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AFBED~1.EXE > nul
        5⤵
        
        PID:908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{9AACF~1.EXE > nul
      4⤵
      PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8BA67~1.EXE > nul
    3⤵
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\93D6EB~1.EXE > nul
  2⤵
  PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe

Path C:\Windows\{0A891FA9-6860-41ce-934D-535BCD1972B7}.exe
Size 98KB
SHA256 91602a60b99b1150053a9a3feffc8d3449e55fb554091633c89425f6ca48f78e
MD5 672b59cc7e28193e638e5cdae6165abe
SHA1 625387f2dac54bb1c823fea635a3c53e01e88c1b
SHA512 b917554ceede01d9fdd7593e0091bf2f422d6b44a0e4b80268611f277c9160a5dbfa97e9b72fd4a800f9f1c24f8ba3e69096d7c5b48be1d27906e32cea90a91b
SSDEEP 768:5vw9816thKQLroc4/wQkNrfrunMxVFA3b7glws:lEG/0oclbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe

Path C:\Windows\{49869DD4-D553-4064-AFD5-E9CB6166F071}.exe
Size 98KB
SHA256 bcd72f9600f3d7e0afdfafaa3c789a3da37ab3b78609325a5ebd420883e7fa70
MD5 721c667564acd3497ac77729f84f6a11
SHA1 5d47190e3be904dd8a09972df4ec68e7c386153e
SHA512 12157f26e0eba1f469fc3da04d36ae7fe7f8263fe54a8a47b16e57559a00fe9391704634c012e4cdab612b7983d2a9c4987096285d4d96f273ae18d8c307a934
SSDEEP 768:5vw9816thKQLro74/wQkNrfrunMxVFA3b7glws:lEG/0o7lbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe

Path C:\Windows\{8BA67FD5-26D5-4071-A8C7-80A8B7C9ABB1}.exe
Size 98KB
SHA256 4758c78a335ca2e7fbf1a5761f8ff5ef228eead925a9b1d9b71a65008e235ce0
MD5 ca75c080cad3f1128e0a6ce157840654
SHA1 d920ddc03f792bdca117dcadf2bd1f2fcf86da5c
SHA512 e1486e782213de60b6620348169aea8b06852d08d13e271cdc85f0788533dc6444b6cb6b933fd9d66c2e756fe49955b5cc76d0ed00a2a7858f0825fb9975157d
SSDEEP 768:5vw9816thKQLroX4/wQkNrfrunMxVFA3b7glws:lEG/0oXlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe

Path C:\Windows\{959BFC8E-844D-46e1-AE16-6B0A1D1479F2}.exe
Size 98KB
SHA256 7c2943999bb925fcd0da627d9fe7050d27ac558b2631600d18f8e5adb89e9d35
MD5 1fedf428f8664e44b2c364b60e62140d
SHA1 086ab94d6126ee4233a5b928973124d53c83771c
SHA512 926be44ac03f0344faba6f1a6d44ab077526672cb8f485c0c93563797568f3d17e4e12fe8c08ddbc115a0fc1fdf97896ed5e835ea9d13e7e5d28a89df1191119
SSDEEP 768:5vw9816thKQLroZ4/wQkNrfrunMxVFA3b7glws:lEG/0oZlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe

Path C:\Windows\{96E7C715-04EE-43ad-BBAF-F6885A679CE3}.exe
Size 98KB
SHA256 7a81a4f589c7e430cb896b0f47c203fa62d3980a11635bc49bff872199b5a2bd
MD5 781f2dd62e621a4104d4965f0f5758e0
SHA1 c234b8566701e67ad81e051d8802152abcdfd2f3
SHA512 984addf95185ec075d9ca44b54ec2c95819647d94286598da60425973e713a5ef42fc52e67c8465affc9f05904ca18258964be8bb627213bdee87db1693d8181
SSDEEP 768:5vw9816thKQLroR4/wQkNrfrunMxVFA3b7glws:lEG/0oRlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe

Path C:\Windows\{9AACF76C-9DCF-4532-8FC1-59602075C094}.exe
Size 98KB
SHA256 f19d08d2dc0702ddb5f1a08422895342e4db324ce564aec876ab3e84bbd931dc
MD5 0e1a18da1dc6393953782dde8a8cf369
SHA1 9ed463fa28dab4f24b7e87c633327e376aafc65a
SHA512 1b74b426d3e6097b7786b5039e321c7e84b244bcadc1eb1a983e8c5b115530e59ab1f14897b594c12f452aeae36e2f39072550c3927a5e04029346020311e74d
SSDEEP 768:5vw9816thKQLros4/wQkNrfrunMxVFA3b7glws:lEG/0oslbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe

Path C:\Windows\{A6ABC831-B759-442b-93C0-2E47CDD999F0}.exe
Size 98KB
SHA256 43ab78600f94a63076e1e6a8c4e74b6108d859bb95819ae3437cd4c9fb791ca4
MD5 7c082ea8ce0d1d73a95d98a6a9085880
SHA1 09f9da8ca8a504b04436d95c0e85d0cd4b6c1024
SHA512 33ac37ddd983ee63950cbade9a18f40cccf12440f656ff3cd18bc71a8dcd06d7fea2af9168a4d5c86d38eff048735e9d17e8a55ad99f7120c1efc0c0c8ff9525
SSDEEP 768:5vw9816thKQLrop4/wQkNrfrunMxVFA3b7glws:lEG/0oplbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{AFBED565-B163-4e33-A081-0EADC483D09C}.exe

Path C:\Windows\{AFBED565-B163-4e33-A081-0EADC483D09C}.exe
Size 98KB
SHA256 7321dd1287cb1bcc86ca9f3a84daaae5e05aa7bf4223984cc1c16d8ff4bcc91a
MD5 741606bbe1d44ab86beb41ff31675e23
SHA1 8cef97ea62ba277a73cc3afcf0504f0977ef16f0
SHA512 8614dd5e9d5af551f7176403687df485a40dbf3d73ef1ce8966785035c9bc0f385b87572638dcfbb432879c694347613ed19caecf0cd10a0345ef237ac7870e8
SSDEEP 768:5vw9816thKQLrot4/wQkNrfrunMxVFA3b7glws:lEG/0otlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{D732F907-6668-4462-999B-141757F17AA8}.exe

Path C:\Windows\{D732F907-6668-4462-999B-141757F17AA8}.exe
Size 98KB
SHA256 dd2d2a6fa78527c427a68f8a879312188b3e80edca5918fde7ef2d8b06b5433e
MD5 bc674ad2cdbd0b6439e71769006a5a15
SHA1 34261c5af6202d5271d322155572475d9fa42e87
SHA512 7383dc613c7a066c3696faa6cc1ae5988fd9e7f998038eadb009e67fd8c35cab29bfda8f98c268accecba2e642e079941226fce374a80f604d99d9c4e6271cc0
SSDEEP 768:5vw9816thKQLroG4/wQkNrfrunMxVFA3b7glws:lEG/0oGlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DB343031-4B96-405d-86AB-973B5ED6533F}.exe

Path C:\Windows\{DB343031-4B96-405d-86AB-973B5ED6533F}.exe
Size 98KB
SHA256 bda6a8607535bff1c1ffa3a4871ddd3598af92d9994bde22dbdb9917aad82c35
MD5 b17f220a9fba587ed9615436282b6f5e
SHA1 1aaf7522a6d752f6927abedc6417d4fb9975ca0b
SHA512 e93c672860ae2849034357a5b6309113109256711546fb0f2f42209b4f2f5ce7b9f249e34d0918294fbf5b4c4adb1c1cacb17a3d91f3c6530198f3dd47e38f4a
SSDEEP 768:5vw9816thKQLro74/wQkNrfrunMxVFA3b7glws:lEG/0o7lbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{F39207E1-649C-486f-BBCE-972B821CB901}.exe

Path C:\Windows\{F39207E1-649C-486f-BBCE-972B821CB901}.exe
Size 98KB
SHA256 3baab503b5e9eadfd56b77adce2f4dc8e031dbdba0565d542ece5f5257d1eedf
MD5 7aa6046f2e330934bbe4f5e3c94527a1
SHA1 73fea684176047befd76147d5cd72195ca94d79d
SHA512 f853a67d87757badc888205c21e811dfdd5e32a727b842e722e7de8985230e802d0c50736f99c8ebe9cf8ab0887192b11aa9102f1df1fbae2688ab1942bd4535
SSDEEP 768:5vw9816thKQLroB4/wQkNrfrunMxVFA3b7glws:lEG/0oBlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

{FA0A322B-B096-4b0f-8A32-3423C123885E}.exe

Path C:\Windows\{FA0A322B-B096-4b0f-8A32-3423C123885E}.exe
Size 98KB
SHA256 d205e8f51e7e88bfab7b57bce5efd3a9ce93205d5e3e3ebde81ab7a07faac1d9
MD5 2bc2cfcf0ba0108f91a8fd8214ad5968
SHA1 a53c5d25cec952c7825f1bb0b95a5a2e00ceae5a
SHA512 a05ca0f917a4a0365e6d1df63e234751d0b0a36418c32aef9006e6b4525bb7799a987725220712c5235c6fb455aa99cccdb7e970415e303db9023a02f7e9197f
SSDEEP 768:5vw9816thKQLror4/wQkNrfrunMxVFA3b7glws:lEG/0orlbunMxVS3Hgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/540-45-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2428-58-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2428-64-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2752-41-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2752-35-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2852-17-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2852-23-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3272-71-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3552-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3552-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4020-50-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4020-46-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4212-57-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4212-52-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4432-12-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4432-15-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4596-33-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4596-30-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4728-10-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4728-4-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4916-65-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4916-69-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4980-24-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4980-28-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads