Analysis
- max time kernel
120s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe
- Size 91KB
- Sample240603-hv5wpagg36
- SHA256 ed9b1e6a02326d33854977fe55757f0e6b0540347d5cb7d718925d2e4a5e2587
- MD5 9f98944de71b5f537af9847bb742b9c0
- SHA1 f99709ac50028117d51d72465dcd9588de266deb
- SHA512 a2bfe5af0bb9a19bd747182f78f7ca7168a8bef198245077a206026bb06096e48b690eaf659cf938932a74fa01410e9fd467f6d4c2694a738a9194908c6dc55d
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GcAwEmBZ04faWmtN4nic+6GL:zGms4Eton0cGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Disables use of System Restore points 1 TTPs
- Executes dropped EXE 7 IoCs
pid Process 3000 xk.exe 1152 IExplorer.exe 2844 WINLOGON.EXE 1188 CSRSS.EXE 2704 SERVICES.EXE 2260 LSASS.EXE 2496 SMSS.EXE - Loads dropped DLL 12 IoCs
pid Process 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell.exe 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shell.exe 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Mig2.scr 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IExplorer.exe 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\xk.exe 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe File created C:\Windows\xk.exe 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\ 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 3000 xk.exe 1152 IExplorer.exe 2844 WINLOGON.EXE 1188 CSRSS.EXE 2704 SERVICES.EXE 2260 LSASS.EXE 2496 SMSS.EXE - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3000 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 3000 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 3000 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 3000 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 1152 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 29 PID 2864 wrote to memory of 1152 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 29 PID 2864 wrote to memory of 1152 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 29 PID 2864 wrote to memory of 1152 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 29 PID 2864 wrote to memory of 2844 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 30 PID 2864 wrote to memory of 2844 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 30 PID 2864 wrote to memory of 2844 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 30 PID 2864 wrote to memory of 2844 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 30 PID 2864 wrote to memory of 1188 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 31 PID 2864 wrote to memory of 1188 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 31 PID 2864 wrote to memory of 1188 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 31 PID 2864 wrote to memory of 1188 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 31 PID 2864 wrote to memory of 2704 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 32 PID 2864 wrote to memory of 2704 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 32 PID 2864 wrote to memory of 2704 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 32 PID 2864 wrote to memory of 2704 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 32 PID 2864 wrote to memory of 2260 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 33 PID 2864 wrote to memory of 2260 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 33 PID 2864 wrote to memory of 2260 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 33 PID 2864 wrote to memory of 2260 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 33 PID 2864 wrote to memory of 2496 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 34 PID 2864 wrote to memory of 2496 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 34 PID 2864 wrote to memory of 2496 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 34 PID 2864 wrote to memory of 2496 2864 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe 34 - System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9f98944de71b5f537af9847bb742b9c0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2864 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1152
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2260
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
- Size 91KB
- SHA256 d611f5cd1063f8d55aef91758f38c2d1928738c7ef0257b7b2c7fbde617491c5
- MD5 a7dcebdb77dcf5c6a86501a95f59df82
- SHA1 a51609b060718d5a8cd07ae7c73956835e600fcd
- SHA512 4c74143a8940ed14e547f95c69f4ef5b069d7636fb25e857a0a6cd110ca7136a914cffdd5ecf71d63118bc194735199eec9ef3842b9f4c160891140fde13a5d4
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GWAwEmBZ04faWmtN4nic+6GL:zGms4Eton0WGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\services.exe
- Size 91KB
- SHA256 ed9b1e6a02326d33854977fe55757f0e6b0540347d5cb7d718925d2e4a5e2587
- MD5 9f98944de71b5f537af9847bb742b9c0
- SHA1 f99709ac50028117d51d72465dcd9588de266deb
- SHA512 a2bfe5af0bb9a19bd747182f78f7ca7168a8bef198245077a206026bb06096e48b690eaf659cf938932a74fa01410e9fd467f6d4c2694a738a9194908c6dc55d
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GcAwEmBZ04faWmtN4nic+6GL:zGms4Eton0cGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\xk.exe
- Size 91KB
- SHA256 aa61181c3f03b1241d1008cfedf628892b6c06627d6ccefcd525e11d6590a345
- MD5 f4ba8a19ae4366940ee7bcdbe90f99a7
- SHA1 dde38b938cb9f24706be7661113837e5e68e3eea
- SHA512 0741a537319ec629438240f475812546513fadfade3b40d0b91a4ca90a2346b4aa13a0d2c63aa04ac69fa51c44bfce807641314d3d9f651f492aeedc3e51177a
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GuAwEmBZ04faWmtN4nic+6GL:zGms4Eton0uGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
- Size 91KB
- SHA256 1e36d9b62cdef58249e90d5ec3e2cc0b7832990f4e25dd1caac5c1c3831039a7
- MD5 6876868c562ae669a01250718c807753
- SHA1 00cc00399a2f46cc77c7c1000c39fc3cff677b57
- SHA512 9a0ebd62ec4d88a385230d3183da28d32c03639833dfaa1e01d0d48a1ceec9051e1567b3f3e86e6f60eebaf0f1c2f0350e7ee999c1a0a44aea22ada631eacad6
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GnAwEmBZ04faWmtN4nic+6GL:zGms4Eton0nGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
- Size 91KB
- SHA256 873867b552ac64e702cfed2b542a276d951a4f01fd96ed2e5e3e94a93b4be7a7
- MD5 a5973339f88cc9aeed34e2b10d9b8a48
- SHA1 247f1e1631337992b35bd64a4c0b7e692a55929b
- SHA512 1512e35c0402817355adbcc62b81761e0ccf0aa24210977d9031e4b0ad145b6f040a79f25229f6dde042257beec3304a2570799b896c0077a6e83e9fce71ae6e
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GOAwEmBZ04faWmtN4nic+6GL:zGms4Eton0OGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
- Size 91KB
- SHA256 bae284b925756ec941548b42ec8438c32f488cee50d60d08e8e4d166a147c337
- MD5 bd21e5025b7657d3a76bc7c0f8f5b71d
- SHA1 8a5ecdb4fa8dfd995ee1dc13d18ad18aae19cb1c
- SHA512 2b489bcc1783a960fae358b245214044264a6837c608abc2e5514a9c0c7820ee0963a2803bb6a2153989c4177be088995c0c1249b712cfee729434c9d2adb7b1
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GGAwEmBZ04faWmtN4nic+6GL:zGms4Eton0GGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
- Size 91KB
- SHA256 318488a56e7e76ea38e96c18e11f11547166cbd60d0a4ad8519da7cd298a26c7
- MD5 58ed4d0480c49c6d963674b65b412b09
- SHA1 a8c58b4be010f97623ebd015ed7f2f7754061d45
- SHA512 d37d6b627bc260459bde07fb60f65ac5f6924e6ee2fb4452e7db71ab7cc601d1bb64cbf5da7a6dfa26f045ef3d2122491b868afc515580c0255b9efc1d989898
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GvAwEmBZ04faWmtN4nic+6GL:zGms4Eton0vGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\IExplorer.exe
- Size 91KB
- SHA256 687b5c662d4ac526e646ff0012e7faed568408bcb2baa3189cadc5b55151149b
- MD5 85ee20dd11cff0cf75237270cac0986f
- SHA1 13b6da7ea27ab17a97dfc8d69e9fc034caf891bf
- SHA512 e19925f0951595643d7650d58be84fa76be9130289a57c80b9cf6c7ed818f301ba017f08c420697b60ea1ec56c0ecf6e68fd331d6e6400e6499c34c373183c0a
- SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GEAwEmBZ04faWmtN4nic+6GL:zGms4Eton0EGms4Eton0L
- MD5 SHA1 SHA512 SSDEEP