Analysis
- max time kernel
117s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2360427656644b245f98427a6b18960_NeikiAnalytics.dll
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
General
- Target a2360427656644b245f98427a6b18960_NeikiAnalytics.dll
- Size 120KB
- Sample240603-ntwvaadc3z
- SHA256 5c7b59262128f6e1aa36cdcd53797c180979be1942c3584f66e9200d26244dc8
- MD5 a2360427656644b245f98427a6b18960
- SHA1 688af57dc5e26189213274589b84edf2001fee26
- SHA512 aa53db912cf20ab6fb357799ee6d5423bd2024c3c20b876aec4d3f4deb85a37ed1c196681951a95b15212dbdee7b57b53744586ab3765063270eb136cf7095ea
- SSDEEP 1536:G7tspb00koMvWUJfBXm1MdxljzFDzG3hFPdwrdOQaObordowgXMoorXoeOXzb2af:G7i0I05Xm14hDzG3hFPGgV+orW2a4N/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578916.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578916.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57bc1c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bc1c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bc1c.exe - Executes dropped EXE 3 IoCs
pid Process 4528 e578916.exe 4928 e578adb.exe 412 e57bc1c.exe -
resource yara_rule behavioral2/memory/4528-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-17-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-26-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-32-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-34-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-11-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-18-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-43-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-44-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-54-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-55-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-56-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-57-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-59-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-61-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4528-64-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/412-97-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/412-90-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/412-98-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/412-89-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/412-87-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/412-92-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/412-136-0x00000000007D0000-0x000000000188A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578916.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bc1c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bc1c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bc1c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bc1c.exe - Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e578916.exe File opened (read-only) \??\K: e578916.exe File opened (read-only) \??\E: e57bc1c.exe File opened (read-only) \??\G: e57bc1c.exe File opened (read-only) \??\E: e578916.exe File opened (read-only) \??\G: e578916.exe File opened (read-only) \??\H: e578916.exe File opened (read-only) \??\I: e578916.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5789a2 e578916.exe File opened for modification C:\Windows\SYSTEM.INI e578916.exe File created C:\Windows\e57e36b e57bc1c.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4528 e578916.exe 4528 e578916.exe 4528 e578916.exe 4528 e578916.exe 412 e57bc1c.exe 412 e57bc1c.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe Token: SeDebugPrivilege 4528 e578916.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 5004 4936 rundll32.exe 83 PID 4936 wrote to memory of 5004 4936 rundll32.exe 83 PID 4936 wrote to memory of 5004 4936 rundll32.exe 83 PID 5004 wrote to memory of 4528 5004 rundll32.exe 84 PID 5004 wrote to memory of 4528 5004 rundll32.exe 84 PID 5004 wrote to memory of 4528 5004 rundll32.exe 84 PID 4528 wrote to memory of 780 4528 e578916.exe 8 PID 4528 wrote to memory of 788 4528 e578916.exe 9 PID 4528 wrote to memory of 332 4528 e578916.exe 13 PID 4528 wrote to memory of 2568 4528 e578916.exe 42 PID 4528 wrote to memory of 2592 4528 e578916.exe 43 PID 4528 wrote to memory of 2760 4528 e578916.exe 47 PID 4528 wrote to memory of 3580 4528 e578916.exe 56 PID 4528 wrote to memory of 3688 4528 e578916.exe 57 PID 4528 wrote to memory of 3892 4528 e578916.exe 58 PID 4528 wrote to memory of 3984 4528 e578916.exe 59 PID 4528 wrote to memory of 4048 4528 e578916.exe 60 PID 4528 wrote to memory of 684 4528 e578916.exe 61 PID 4528 wrote to memory of 4168 4528 e578916.exe 62 PID 4528 wrote to memory of 4468 4528 e578916.exe 64 PID 4528 wrote to memory of 2716 4528 e578916.exe 75 PID 4528 wrote to memory of 4256 4528 e578916.exe 80 PID 4528 wrote to memory of 1880 4528 e578916.exe 81 PID 4528 wrote to memory of 4936 4528 e578916.exe 82 PID 4528 wrote to memory of 5004 4528 e578916.exe 83 PID 4528 wrote to memory of 5004 4528 e578916.exe 83 PID 5004 wrote to memory of 4928 5004 rundll32.exe 85 PID 5004 wrote to memory of 4928 5004 rundll32.exe 85 PID 5004 wrote to memory of 4928 5004 rundll32.exe 85 PID 4528 wrote to memory of 780 4528 e578916.exe 8 PID 4528 wrote to memory of 788 4528 e578916.exe 9 PID 4528 wrote to memory of 332 4528 e578916.exe 13 PID 4528 wrote to memory of 2568 4528 e578916.exe 42 PID 4528 wrote to memory of 2592 4528 e578916.exe 43 PID 4528 wrote to memory of 2760 4528 e578916.exe 47 PID 4528 wrote to memory of 3580 4528 e578916.exe 56 PID 4528 wrote to memory of 3688 4528 e578916.exe 57 PID 4528 wrote to memory of 3892 4528 e578916.exe 58 PID 4528 wrote to memory of 3984 4528 e578916.exe 59 PID 4528 wrote to memory of 4048 4528 e578916.exe 60 PID 4528 wrote to memory of 684 4528 e578916.exe 61 PID 4528 wrote to memory of 4168 4528 e578916.exe 62 PID 4528 wrote to memory of 4468 4528 e578916.exe 64 PID 4528 wrote to memory of 2716 4528 e578916.exe 75 PID 4528 wrote to memory of 4256 4528 e578916.exe 80 PID 4528 wrote to memory of 1880 4528 e578916.exe 81 PID 4528 wrote to memory of 4936 4528 e578916.exe 82 PID 4528 wrote to memory of 4928 4528 e578916.exe 85 PID 4528 wrote to memory of 4928 4528 e578916.exe 85 PID 4528 wrote to memory of 1496 4528 e578916.exe 87 PID 4528 wrote to memory of 1672 4528 e578916.exe 89 PID 5004 wrote to memory of 412 5004 rundll32.exe 91 PID 5004 wrote to memory of 412 5004 rundll32.exe 91 PID 5004 wrote to memory of 412 5004 rundll32.exe 91 PID 412 wrote to memory of 780 412 e57bc1c.exe 8 PID 412 wrote to memory of 788 412 e57bc1c.exe 9 PID 412 wrote to memory of 332 412 e57bc1c.exe 13 PID 412 wrote to memory of 2568 412 e57bc1c.exe 42 PID 412 wrote to memory of 2592 412 e57bc1c.exe 43 PID 412 wrote to memory of 2760 412 e57bc1c.exe 47 PID 412 wrote to memory of 3580 412 e57bc1c.exe 56 PID 412 wrote to memory of 3688 412 e57bc1c.exe 57 PID 412 wrote to memory of 3892 412 e57bc1c.exe 58 PID 412 wrote to memory of 3984 412 e57bc1c.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bc1c.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2592
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2760
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3580
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2360427656644b245f98427a6b18960_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2360427656644b245f98427a6b18960_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\e578916.exeC:\Users\Admin\AppData\Local\Temp\e578916.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4528
-
-
C:\Users\Admin\AppData\Local\Temp\e578adb.exeC:\Users\Admin\AppData\Local\Temp\e578adb.exe4⤵
- Executes dropped EXE
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\e57bc1c.exeC:\Users\Admin\AppData\Local\Temp\e57bc1c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:412
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3688
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4048
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:684
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4168
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4468
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2716
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4256
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1880
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1496
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1672
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e578916.exe
- Size 97KB
- SHA256 ad579386d941e9789d3353eefcab5aea190827008cb1cd66b04d0e1fe9a156e9
- MD5 8dd73b4eaab79b2ce1329ccc937b7194
- SHA1 2ac606e26942606a54c0a72d30ea56a897d4d4a5
- SHA512 251e792e5a6b3b71ccf2adec151fcef87a4ce98855a4e476f21e1b3d80bcd65d29f1aadc96ad46c9cc1a5047dd5463a2382f83121bc316ac3f73ca0de2cdb561
- SSDEEP 3072:567vFdm9z/QCFR5gr/OhXx4CNiFZuxZgTel:c7nm9zrR5gjQomXg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 205aa276ff2d0b83bbe56914235a40b0a19bcb1b5e938b3837e9e38aa752182b
- MD5 413d2cc062e4dfa97c608b6a4ac04af8
- SHA1 b8694e6ba0c077499aa215881487ce7a98d9da6e
- SHA512 13915c7efd7d37a06487cb1e6d02e31f0226e648a189bd6408c573d3313207eb747fbe0ec42a793ae14b0f2cbfd634ba0831f1b362035b0568faec1cf59eb06a
- MD5 SHA1 SHA512