c53cd48d775b617fa66e0fa29faa4cd5588c246b20d05726b0a8730ca87af459

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Size 91KB
Sample240603-df242agg8y
SHA256 c53cd48d775b617fa66e0fa29faa4cd5588c246b20d05726b0a8730ca87af459
MD5 990516abde06236247cb12203e637b00
SHA1 0cf9a0169dc3265faee8122875289ff52cc14383
SHA512 c4019972e34ae53c5e9cfe472f86ae112782f2671bf6ddb0ff1b6f5653e5f94453207698fe980c6742f0dbd63d3808958e9de31b9f0611a41e8622a1994a4ea3
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuF3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4iT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
2528	xk.exe
4536	IExplorer.exe
4084	WINLOGON.EXE
4220	CSRSS.EXE
1164	SERVICES.EXE
4844	LSASS.EXE
3564	SMSS.EXE
1940	xk.exe
2780	IExplorer.exe
4848	WINLOGON.EXE
2276	CSRSS.EXE
4740	SERVICES.EXE
3876	LSASS.EXE
1800	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File created	C:\desktop.ini	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened for modification	F:\desktop.ini	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File created	F:\desktop.ini	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\B:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\I:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\L:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\O:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\S:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\E:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\P:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\R:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\W:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\U:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\G:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\H:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\K:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\M:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\N:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\J:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\T:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\X:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mig2.scr	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
2528	xk.exe
4536	IExplorer.exe
4084	WINLOGON.EXE
4220	CSRSS.EXE
1164	SERVICES.EXE
4844	LSASS.EXE
3564	SMSS.EXE
1940	xk.exe
2780	IExplorer.exe
4848	WINLOGON.EXE
2276	CSRSS.EXE
4740	SERVICES.EXE
3876	LSASS.EXE
1800	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2528	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	85
PID 3596 wrote to memory of 2528	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	85
PID 3596 wrote to memory of 2528	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	85
PID 3596 wrote to memory of 4536	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	86
PID 3596 wrote to memory of 4536	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	86
PID 3596 wrote to memory of 4536	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	86
PID 3596 wrote to memory of 4084	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	87
PID 3596 wrote to memory of 4084	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	87
PID 3596 wrote to memory of 4084	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	87
PID 3596 wrote to memory of 4220	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	88
PID 3596 wrote to memory of 4220	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	88
PID 3596 wrote to memory of 4220	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	88
PID 3596 wrote to memory of 1164	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	90
PID 3596 wrote to memory of 1164	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	90
PID 3596 wrote to memory of 1164	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	90
PID 3596 wrote to memory of 4844	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	91
PID 3596 wrote to memory of 4844	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	91
PID 3596 wrote to memory of 4844	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	91
PID 3596 wrote to memory of 3564	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	93
PID 3596 wrote to memory of 3564	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	93
PID 3596 wrote to memory of 3564	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	93
PID 3596 wrote to memory of 1940	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	94
PID 3596 wrote to memory of 1940	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	94
PID 3596 wrote to memory of 1940	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	94
PID 3596 wrote to memory of 2780	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	95
PID 3596 wrote to memory of 2780	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	95
PID 3596 wrote to memory of 2780	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	95
PID 3596 wrote to memory of 4848	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	96
PID 3596 wrote to memory of 4848	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	96
PID 3596 wrote to memory of 4848	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	96
PID 3596 wrote to memory of 2276	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 2276	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 2276	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	97
PID 3596 wrote to memory of 4740	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	98
PID 3596 wrote to memory of 4740	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	98
PID 3596 wrote to memory of 4740	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	98
PID 3596 wrote to memory of 3876	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	99
PID 3596 wrote to memory of 3876	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	99
PID 3596 wrote to memory of 3876	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	99
PID 3596 wrote to memory of 1800	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	100
PID 3596 wrote to memory of 1800	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	100
PID 3596 wrote to memory of 1800	3596	990516abde06236247cb12203e637b00_NeikiAnalytics.exe	100

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	990516abde06236247cb12203e637b00_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	990516abde06236247cb12203e637b00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\990516abde06236247cb12203e637b00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\990516abde06236247cb12203e637b00_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3596
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2528
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4536
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4084
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4220
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1164
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4844
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3564
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1940
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2780
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4848
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2276
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4740
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3876
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 d8eb346639b91659dcd406adab2e661bf5b304fc154938154a7469c1289403cd
MD5 21f65a27f94ed0c037dc1bc72d9640cf
SHA1 fce7755e2177e86ffb2fc56c6fa8e5707d15eb93
SHA512 780c6799930ecea8fc8e9812252b67c0182ec13bd31c7d6c69a2980a86368aefb51481daeea3b82c8b41472fbd06f8f11dd99146691c4d272d9944672fcee1af
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imum43gRYjXbUeHORIC40:uT3OA3+KQsxfS4GT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 9116e990c575508d1c283cebe2cffd02f84cf3ddc56690f5774d8e2d15d8b390
MD5 2ddef3944f94adf2f1c8a7870b21b1bc
SHA1 158bb2eb1104c270753806171cc4bf92d75f0a69
SHA512 1c3cf4d80bf2feaab0e55d477e16eda5c6622852888c52628edbba023e8478a618fc8edf5cf07a53de32ef1b521322b3fcde4a775eca4a9de147e86a53046c4d
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuA3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS43T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 86e9516a04e71a1efa1a74448eb45c81e61bfa8bc76087d4490423ce4e620a2a
MD5 43a1ed6fd357b0a2f80c573b98c16adb
SHA1 40614d6831de9ee14361ca3ded676de573753968
SHA512 d1d3b570fd5cd6a74479afb62b7121ffc928e1245ddc4ece5c4b8c95a15f729812592b4dd5ee8c1ace51caf8d9584b06f26989e9a887c131b59c72125d2bafb9
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imue3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS45T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 dffb1a71a740246f54e41b8317c6fc52a39109a626529f3e529dbd0a7d2d77f2
MD5 64488f767fd103d27e95831a798dbdb6
SHA1 d019e54336951c05c48f7453d438b547329c30eb
SHA512 92b2ae4d7c53ccc71716cc62de8d89396a5c55be19b980f9ec9d040fe33d379fafadccbc31229020004d474b0b3d11b70a788f0ecd62e85b78b660c675cceeb4
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imur3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4MT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 1aed4a8421464421df5acf6bd1a1e0fbf794150f997627adcc56cf31d87779bf
MD5 d3c09e1ffb2aa119b1a7b4988a01e32f
SHA1 2070576ff3a8f0bec016b931229ef1a3149ef67f
SHA512 888b2343ed098d55bf44cfd4c311c4e5760dfb84aae18c9fcc41799e11d19584c826c1766213248c566629bb730c7121714577157649120f49f622f1cb869fe8
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuP3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4gT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 54198563f647d39f0661888d9883acdc0a88860382a88f4683ac098abf79f5d0
MD5 448b1ae16f3de40081ed1ede8ecd9038
SHA1 5ec71d30c369fc5787f7d41af13259cf86dc668e
SHA512 90bbfc89749de626c48a4ec36389d395159e2298f53210c9234c8350e85502f4aa1d3571f8752becfa974f7a6623f6d6fa6dd78e80e448116278fa3992a8952c
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuA3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4nT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 3b0c547c75bbcd11c83e119c0fe1e5f03eb458e5e2b1764ee98b71db37c13470
MD5 1a7e3eb5b5d5b7690ce211885be4fda1
SHA1 03adcb6f48c6e49ffca3cd746173c0e502cf706c
SHA512 b8c49de8610c1bddfdbba7511b3edacbc16122dfa884f5f5602ff10b3603e522da81f27fe63a4e170a46769e1f0d0335cc872f11fb8b267dc73780d08fb1d6a0
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuz3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4oT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 713f2b73e1400b5f2668eacf47c7d2705e720129c197b69a3f8f799975c02c00
MD5 cb9ab4d5f9fd6a349df80607839ee010
SHA1 1e53e443e8eb4f8ed864010492ebdbc92d54ea23
SHA512 26034b69020f0f6227b66c6b57e6354344d4e18263ae13efa3ebfbba40f7f7f34d428867fc15069fc615db16e1bc11b93ed3a38999da7b5f7935a86e4d2978b2
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imul3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4eT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 615e69ebd346feb3406aa16f30e9014835d27721e7b61b36b97450b6190d56ce
MD5 57d35870ed4fab0ec29d2b5dc6ddb148
SHA1 8aadb2c7e21f1461ae19d4fa193452bc28a49c2a
SHA512 1f8987c3550006386a6b4b0f655a1f883bd63f98062b4ed668d91398a764895a5c25c4103c3f9cbf84b888b30ce861d3000926f1312d9e6386176ca8e97bc187
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImumI3gRYjXbUeHORIC40:uT3OA3+KQsxfS4CT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 c53cd48d775b617fa66e0fa29faa4cd5588c246b20d05726b0a8730ca87af459
MD5 990516abde06236247cb12203e637b00
SHA1 0cf9a0169dc3265faee8122875289ff52cc14383
SHA512 c4019972e34ae53c5e9cfe472f86ae112782f2671bf6ddb0ff1b6f5653e5f94453207698fe980c6742f0dbd63d3808958e9de31b9f0611a41e8622a1994a4ea3
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuF3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4iT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 75138ae676cb4dc849420437c06af06b7b6b9082034c86eca426abb82f06656b
MD5 27c15c1a74805e4006f406fd3784efdd
SHA1 625e584cff6f77fe526da591088a46e65a32b2c7
SHA512 235622ddfd9aa58fe8f214cbc25a1b927c17516c517ae399f1b0db50cf29d1afaff14a383d4fa43446a358caa8f4e7d13f2e001ea606a3a9f1555beb3440b532
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu3L3gRYjXbUeHORIC40:uT3OA3+KQsxfS4AT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 7654ef5576205207360d72e8b6df049505166d6beda832457d90fabcd4e42c6a
MD5 d45a3c051ce3b9f0f5438abd905fc633
SHA1 ea70090c174f838136bbda1d78e98547f5748158
SHA512 faac0895f297a949d9c37c8852b0a71d90d5bcd4207326ead381fde9ee6db8a513a58932caffea5fd4594411386910d58cbc925d86039daf8f569c48f0d6a94d
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuik3gRYjXbUeHORIC40:uT3OA3+KQsxfS4lOT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 a7e4f26f20e0170d7cf440cd5eedb816e1bb33b4621b173b0e1cfb30a0cc47a7
MD5 f22f7f0817e8c43f77b1a344f9dbea7e
SHA1 f5097e76e2bb9cb7b94bec4c5b8390a0c021f677
SHA512 3158dccc102b6f40b2aad4417af3485b4e89a6036db7c2675d647e5e98704ee8666b1cc50ce8e5d25b6a47636f8ec327a8a82f1dcb8ba6a261a133f6f59d48fd
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imua3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS49T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 01b45dfb1f13fdaee5541b2664cb82fd359c7c541fafe03cccaba430a7d3a667
MD5 158016d39baf61844dc76be0efdbfd3e
SHA1 47aa8fd3fb10cc56193117935248c088ef1377ca
SHA512 fc961f6dd4e63ddd42e1397c1f294baffd964acf00532eec71031da5afc9f93b9818261edb3288ab632979a36a099c412dee51c813c692564c1b2271b0de8a5f
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuq3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS49T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 e9d77b883a45b87fdf29a23775a05eaba6d5156536564997caff3a78bdca8684
MD5 f6dadf5b51253a049c1d2f7148757643
SHA1 4f6d4872ea9f528f71e58bde1e2b3ec4b4997ddf
SHA512 f1c2f2db310cc8d752aa1682784736094c4bd233d6b3f711240b27bd68045acd3f3578e718eb0df1b658cd30bcb949ed8f0b4daa14d2a8041ddc9ed1bc7b67e6
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuIBS3gRYjXbUeHORIC3:uT3OA3+KQsxfS4BBwT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1164-154-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/1164-158-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1164-161-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1800-278-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1800-273-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/1940-226-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/1940-230-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2276-249-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/2276-254-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2528-119-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2528-112-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/2528-113-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2528-117-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2780-238-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2780-233-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/3564-185-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3564-173-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/3596-142-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/3596-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3596-307-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/3596-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3596-3-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3596-2-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/3596-4-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/3596-306-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3596-304-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3876-265-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/3876-271-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4084-139-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4084-132-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/4084-136-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4220-143-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4220-150-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4220-144-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/4220-147-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4536-126-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4536-128-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4536-122-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/4740-257-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/4740-262-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4844-169-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4844-164-0x0000000075600000-0x000000007575D000-memory.dmp

Download

memory/4848-247-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4848-241-0x0000000075600000-0x000000007575D000-memory.dmp

Download