Analysis
- max time kernel
92s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe
- Size 45KB
- Sample240603-e2syxscf26
- SHA256 264fa265d2024f09f0358bc902e390f9482aa6144671cad71ca22fac8666ef02
- MD5 9b756ab85236b4cc29a55e1cab4bc9b0
- SHA1 85377f2b99937033cc2a14eebdb4629cf09cf0d8
- SHA512 e6cbac67fec6618a8bfe4eeecd7e567c88f818b19b7b5bc77a9ad1dec4a9c15ee43a2b04f25f7f7c959ac77506e41c241b447874fa4c23a02e6d516ab711dd13
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEq:8AwEmBj3EXHn4x+9aq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 3700 xk.exe 5008 IExplorer.exe 4984 WINLOGON.EXE 3168 CSRSS.EXE 3612 SERVICES.EXE 2164 LSASS.EXE 436 SMSS.EXE - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Mig2.scr 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\shell.exe 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shell.exe 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Mig2.scr 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IExplorer.exe 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe File created C:\Windows\xk.exe 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\Desktop\ 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 3700 xk.exe 5008 IExplorer.exe 4984 WINLOGON.EXE 3168 CSRSS.EXE 3612 SERVICES.EXE 2164 LSASS.EXE 436 SMSS.EXE - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3804 wrote to memory of 3700 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 81 PID 3804 wrote to memory of 3700 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 81 PID 3804 wrote to memory of 3700 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 81 PID 3804 wrote to memory of 5008 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 82 PID 3804 wrote to memory of 5008 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 82 PID 3804 wrote to memory of 5008 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 82 PID 3804 wrote to memory of 4984 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 83 PID 3804 wrote to memory of 4984 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 83 PID 3804 wrote to memory of 4984 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 83 PID 3804 wrote to memory of 3168 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 85 PID 3804 wrote to memory of 3168 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 85 PID 3804 wrote to memory of 3168 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 85 PID 3804 wrote to memory of 3612 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 86 PID 3804 wrote to memory of 3612 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 86 PID 3804 wrote to memory of 3612 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 86 PID 3804 wrote to memory of 2164 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 87 PID 3804 wrote to memory of 2164 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 87 PID 3804 wrote to memory of 2164 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 87 PID 3804 wrote to memory of 436 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 89 PID 3804 wrote to memory of 436 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 89 PID 3804 wrote to memory of 436 3804 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe 89 - System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9b756ab85236b4cc29a55e1cab4bc9b0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3804 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3700
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5008
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4984
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3168
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2164
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:436
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 45KB
- SHA256 edf2a84b43f7e0d02143d16fa12796380a3dc2c3e4d5cd073bb2cd69332642f4
- MD5 e08b44ddaed3c105a7396426983f19eb
- SHA1 335eff8ab8b2eacd088ce6d4c1c3194f1bb7a66f
- SHA512 43e3071ea936582abd861c3cb7ee6921485597933835244ae38cb6718c3a946e0f8524f23b4abcd28072118604e1e2a650a22cb40f36891a36dc8fbffdb1afb7
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEu:8AwEmBj3EXHn4x+9au
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 45KB
- SHA256 c518b94e1be43dbcc947eb1733bcdd8312e41b6f4b3a5c7121fbbea1a9bafa39
- MD5 dc1cb1a729703585cf932c37a4b99ae5
- SHA1 e80b66df61c2c5ff84c69666d706a8bb1f8e104d
- SHA512 e176c8d40b58c1bc5550cf33a5970560bbe78dc629411c84c1454619945dd2cf0b253b2d8e5a37d32947baff560c747ad9ff36acd6e5a387d10837c9ea90ae7a
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEaV:8AwEmBj3EXHn4x+9as
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 45KB
- SHA256 0913e042c9c409eb7fe42a3845fd97407ed4f76ad25a7a25650fe2071633bf87
- MD5 d4ee470c6af887db10dc2e93b092ab31
- SHA1 87690b46c7eb6bced5aa593f373f9c4454ca4c66
- SHA512 1ccf5b2074002abe2bb22b77977aeb3c1d6368ade4da07e505aff54e493c7cfe02f8d4622c63956943796739af71f0cfb3b7bfc4f84265167653a5662be4d2f8
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEB:8AwEmBj3EXHn4x+9aB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 45KB
- SHA256 b7859526108ddbc63d0a996e3df991dba303b2e6d390bfd368f5c9491cf7e391
- MD5 77af507a1c3ff2793d2533199b69c75a
- SHA1 3599f5c8b9becffd4bc7a7dc14a67a01d57fb3b6
- SHA512 01d96ee9143607bcfc71f56f3d4c04cd9e520f5095f6bbcdeb5459f387b0a7b9353b5cfa95c96c1e31e70009b4dcb6d5ba6f3f79162cb345cbf8cbd137bdae56
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEy:8AwEmBj3EXHn4x+9ay
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
- Size 45KB
- SHA256 f89e72685dd9e4a36e7c3b0174eae0bbd26b874c77034e7c7f09c9570de50084
- MD5 9b6e36640a4669c76dd39b743be6a792
- SHA1 e0e3a1db432645d87f2db79b41e0740072eedb3b
- SHA512 7b43ac23227c96863c936f16eeb21e0fd14be7b12f9194093e4ff4b80d9c58081a98a415611e08b11752390bdadfceff2ea53f623ee521ebed3ed49f91e12d3a
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nE5:8AwEmBj3EXHn4x+9a5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\winlogon.exe
- Size 45KB
- SHA256 264fa265d2024f09f0358bc902e390f9482aa6144671cad71ca22fac8666ef02
- MD5 9b756ab85236b4cc29a55e1cab4bc9b0
- SHA1 85377f2b99937033cc2a14eebdb4629cf09cf0d8
- SHA512 e6cbac67fec6618a8bfe4eeecd7e567c88f818b19b7b5bc77a9ad1dec4a9c15ee43a2b04f25f7f7c959ac77506e41c241b447874fa4c23a02e6d516ab711dd13
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEq:8AwEmBj3EXHn4x+9aq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\IExplorer.exe
- Size 45KB
- SHA256 8e85ccc9aa1592bf668f492130e4b11e2aadbf39037b4a840bcc2f63f64d6462
- MD5 1ae711fcffa954a7e1cfd1264cab762c
- SHA1 f5b32660d2a27a95ca6f93a7de4a91a05da73ee2
- SHA512 5bb537067364c1dc3f5130c6279133cdeec0a5eb343bfebb466fdb3f93eac730052ab14c4f4d1af1a7336d09ebdc34d3d45323fd19c27689ee62d2e282be7c67
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nE/:8AwEmBj3EXHn4x+9a/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 45KB
- SHA256 d3a642c9f971efa47b3153acc8c592878c38f51f80e1c4eed9d1a69553357d28
- MD5 d61b4248bf00bd3afd74b8b68ec956f7
- SHA1 227f40cff167b090bd4c092692824c4408aba331
- SHA512 6bc7a68eb3a941d4092048958b5c98a14d464a55f69c0e3cfeff1bc934bf0f7e041ba8d60c18a692583e439d887b2aff12784b42c41a340bde336bc4bf9e03fb
- SSDEEP 768:2mFQj8rM9whcqet8WfYUtT92S21XFXRnnePxCXNvF7DFK+5nEn:8AwEmBj3EXHn4x+9an
- MD5 SHA1 SHA512 SSDEEP