Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe
-
Size
80KB
-
MD5
0bd89d5bb47e6638e0c3560a06bdbc10
-
SHA1
d34ceb7145722e2bee9471970cc3023467b8a679
-
SHA256
5dd3b3f9bc7fe3ba2fbf8f3cb9bbebd2804eb2af4979c028a4ecc30060db9ddb
-
SHA512
1c69ae73e6bb4016430d0187a09460a40bcdb9b798bf6c2c6c389848432deaed38d4867b651417f94a41bf4ee9bc2efd39fa58f2b230233000f0e34a400e5711
-
SSDEEP
384:vbLwOs8AHsc4sMfwhKQLroH4/CFsrdOI1Nb7g7FX7XYfruVDtM9tQ/FKlnVwUUOV:vvw9816vhKQLroH4/wQRNrfrunMxVFAi
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E714F58-DD98-4739-AFBA-7A4666C88E40} {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69CA6B25-5C31-46e3-B5B9-CA15BA7015EB} {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC81391F-71E5-47f0-9C37-0ADE5A2C789A} {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6FAF644-B858-426a-ABAE-1D0E9DC4B30C} {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93F44667-9F9D-4b3a-9F08-0C01DDB29D02}\stubpath = "C:\\Windows\\{93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe" {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}\stubpath = "C:\\Windows\\{3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe" {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}\stubpath = "C:\\Windows\\{0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe" {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93F44667-9F9D-4b3a-9F08-0C01DDB29D02} {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE197D20-9784-4d28-9768-0396C25D6A1B}\stubpath = "C:\\Windows\\{EE197D20-9784-4d28-9768-0396C25D6A1B}.exe" {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A218866-07DE-4e95-8B62-0046884D9A5B} 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}\stubpath = "C:\\Windows\\{69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe" {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31397972-2DDD-49e2-A629-D7C4F8DBC466} {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A} {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31397972-2DDD-49e2-A629-D7C4F8DBC466}\stubpath = "C:\\Windows\\{31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe" {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}\stubpath = "C:\\Windows\\{D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe" {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E714F58-DD98-4739-AFBA-7A4666C88E40}\stubpath = "C:\\Windows\\{9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe" {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE197D20-9784-4d28-9768-0396C25D6A1B} {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{651E850C-DE90-4de1-BED1-202FED6CAE27}\stubpath = "C:\\Windows\\{651E850C-DE90-4de1-BED1-202FED6CAE27}.exe" {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A218866-07DE-4e95-8B62-0046884D9A5B}\stubpath = "C:\\Windows\\{4A218866-07DE-4e95-8B62-0046884D9A5B}.exe" 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC81391F-71E5-47f0-9C37-0ADE5A2C789A}\stubpath = "C:\\Windows\\{CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe" {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AEC674E-A9A0-4bca-A7B4-47D9662BE93C} {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{651E850C-DE90-4de1-BED1-202FED6CAE27} {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe -
Executes dropped EXE 11 IoCs
pid Process 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 892 {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe 4480 {EE197D20-9784-4d28-9768-0396C25D6A1B}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe File created C:\Windows\{69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe File created C:\Windows\{CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe File created C:\Windows\{651E850C-DE90-4de1-BED1-202FED6CAE27}.exe {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe File created C:\Windows\{EE197D20-9784-4d28-9768-0396C25D6A1B}.exe {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe File created C:\Windows\{31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe File created C:\Windows\{D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe File created C:\Windows\{3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe File created C:\Windows\{0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe File created C:\Windows\{93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe File created C:\Windows\{9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe Token: SeIncBasePriorityPrivilege 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe Token: SeIncBasePriorityPrivilege 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe Token: SeIncBasePriorityPrivilege 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe Token: SeIncBasePriorityPrivilege 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe Token: SeIncBasePriorityPrivilege 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe Token: SeIncBasePriorityPrivilege 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe Token: SeIncBasePriorityPrivilege 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe Token: SeIncBasePriorityPrivilege 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe Token: SeIncBasePriorityPrivilege 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe Token: SeIncBasePriorityPrivilege 892 {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 5040 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe 91 PID 2648 wrote to memory of 5040 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe 91 PID 2648 wrote to memory of 5040 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe 91 PID 2648 wrote to memory of 2644 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe 92 PID 2648 wrote to memory of 2644 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe 92 PID 2648 wrote to memory of 2644 2648 0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe 92 PID 5040 wrote to memory of 1384 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 101 PID 5040 wrote to memory of 1384 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 101 PID 5040 wrote to memory of 1384 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 101 PID 5040 wrote to memory of 1104 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 102 PID 5040 wrote to memory of 1104 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 102 PID 5040 wrote to memory of 1104 5040 {4A218866-07DE-4e95-8B62-0046884D9A5B}.exe 102 PID 1384 wrote to memory of 3248 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 104 PID 1384 wrote to memory of 3248 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 104 PID 1384 wrote to memory of 3248 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 104 PID 1384 wrote to memory of 3284 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 105 PID 1384 wrote to memory of 3284 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 105 PID 1384 wrote to memory of 3284 1384 {69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe 105 PID 3248 wrote to memory of 2868 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 106 PID 3248 wrote to memory of 2868 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 106 PID 3248 wrote to memory of 2868 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 106 PID 3248 wrote to memory of 3628 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 107 PID 3248 wrote to memory of 3628 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 107 PID 3248 wrote to memory of 3628 3248 {31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe 107 PID 2868 wrote to memory of 3016 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 108 PID 2868 wrote to memory of 3016 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 108 PID 2868 wrote to memory of 3016 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 108 PID 2868 wrote to memory of 2284 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 109 PID 2868 wrote to memory of 2284 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 109 PID 2868 wrote to memory of 2284 2868 {CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe 109 PID 3016 wrote to memory of 4016 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 110 PID 3016 wrote to memory of 4016 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 110 PID 3016 wrote to memory of 4016 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 110 PID 3016 wrote to memory of 3652 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 111 PID 3016 wrote to memory of 3652 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 111 PID 3016 wrote to memory of 3652 3016 {D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe 111 PID 4016 wrote to memory of 1416 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 112 PID 4016 wrote to memory of 1416 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 112 PID 4016 wrote to memory of 1416 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 112 PID 4016 wrote to memory of 3432 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 113 PID 4016 wrote to memory of 3432 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 113 PID 4016 wrote to memory of 3432 4016 {3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe 113 PID 1416 wrote to memory of 1612 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 114 PID 1416 wrote to memory of 1612 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 114 PID 1416 wrote to memory of 1612 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 114 PID 1416 wrote to memory of 2692 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 115 PID 1416 wrote to memory of 2692 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 115 PID 1416 wrote to memory of 2692 1416 {0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe 115 PID 1612 wrote to memory of 2264 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 116 PID 1612 wrote to memory of 2264 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 116 PID 1612 wrote to memory of 2264 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 116 PID 1612 wrote to memory of 404 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 117 PID 1612 wrote to memory of 404 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 117 PID 1612 wrote to memory of 404 1612 {93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe 117 PID 2264 wrote to memory of 892 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 118 PID 2264 wrote to memory of 892 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 118 PID 2264 wrote to memory of 892 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 118 PID 2264 wrote to memory of 3916 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 119 PID 2264 wrote to memory of 3916 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 119 PID 2264 wrote to memory of 3916 2264 {9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe 119 PID 892 wrote to memory of 4480 892 {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe 120 PID 892 wrote to memory of 4480 892 {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe 120 PID 892 wrote to memory of 4480 892 {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe 120 PID 892 wrote to memory of 3180 892 {651E850C-DE90-4de1-BED1-202FED6CAE27}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0bd89d5bb47e6638e0c3560a06bdbc10_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\{4A218866-07DE-4e95-8B62-0046884D9A5B}.exeC:\Windows\{4A218866-07DE-4e95-8B62-0046884D9A5B}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\{69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exeC:\Windows\{69CA6B25-5C31-46e3-B5B9-CA15BA7015EB}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\{31397972-2DDD-49e2-A629-D7C4F8DBC466}.exeC:\Windows\{31397972-2DDD-49e2-A629-D7C4F8DBC466}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\{CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exeC:\Windows\{CC81391F-71E5-47f0-9C37-0ADE5A2C789A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\{D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exeC:\Windows\{D6FAF644-B858-426a-ABAE-1D0E9DC4B30C}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\{3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exeC:\Windows\{3FE6E911-8CAF-4c32-AAD3-EB2328E0B98A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\{0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exeC:\Windows\{0AEC674E-A9A0-4bca-A7B4-47D9662BE93C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\{93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exeC:\Windows\{93F44667-9F9D-4b3a-9F08-0C01DDB29D02}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\{9E714F58-DD98-4739-AFBA-7A4666C88E40}.exeC:\Windows\{9E714F58-DD98-4739-AFBA-7A4666C88E40}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\{651E850C-DE90-4de1-BED1-202FED6CAE27}.exeC:\Windows\{651E850C-DE90-4de1-BED1-202FED6CAE27}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\{EE197D20-9784-4d28-9768-0396C25D6A1B}.exeC:\Windows\{EE197D20-9784-4d28-9768-0396C25D6A1B}.exe12⤵
- Executes dropped EXE
PID:4480
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{651E8~1.EXE > nul12⤵PID:3180
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E714~1.EXE > nul11⤵PID:3916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93F44~1.EXE > nul10⤵PID:404
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0AEC6~1.EXE > nul9⤵PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3FE6E~1.EXE > nul8⤵PID:3432
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6FAF~1.EXE > nul7⤵PID:3652
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC813~1.EXE > nul6⤵PID:2284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31397~1.EXE > nul5⤵PID:3628
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69CA6~1.EXE > nul4⤵PID:3284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A218~1.EXE > nul3⤵PID:1104
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\0BD89D~1.EXE > nul2⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3280 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵PID:3088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD598c85edd817872e3c61cceca800439ee
SHA1ba2817d2d3c08baca196c301e7697d56607d5ed4
SHA256906120713c1d7f484b85768701431320a8a98bce1ba6023a40da1a418efb1672
SHA512e9b27feced929f0fff8873248383b0bcce801053eeb30134f6be0d7cf62aad71d74ebdacd4643ec39452038be5f59465f384a085cddd8bba59d5c54c9f95a23d
-
Filesize
80KB
MD5133b78ddc9a707a8ace909830976e175
SHA175b82cbd3013725aaf108cadb9dcb7d53102d546
SHA256ea267239a9d6aba1f925b04aeb27ef58c3ec08fc1a519f73add8a2e02d6d067d
SHA512cbd4183149f8ce2f088ed19b4e6c9c8e50c6d1193e0a10221ac9cc1ae4fafd2083e1a043a8e0f65596562ce053f98072b6475815c986a6c3758d9b3fa05ada59
-
Filesize
80KB
MD5594dcaf8a765ece488e82071b2b9a7da
SHA15cbe6ba07a7493a5c0ceef74327c73db1d87a26b
SHA2568225d73ccc6d749aebf76521954ca10d72abd201544bc3d8659a99ebc3eecf18
SHA512304dbf673ac2e651a587fdf9bfbc47dca613fe53baed0a46649b2d1dc30f68f12c5ab89e1982d73de0a61f0f3f84f0aef3f4a3105a0f4a3d9aaee41676404dbb
-
Filesize
80KB
MD5d4db54d19248678b0d88dc65b4a811b1
SHA19c9e738bdb20bfe5001a14f9347b0ba0b79f0aba
SHA2566693be6515ab89ac4754153cfc01e6dbb6296f545ef65e426ad462adb5c0f5b4
SHA512ad1d7851f9c5cf6cd67e6bf0500780bde6786a9d45ec19a14bb853eb1925d9720819b078a185a174efbb78112a44fda613ab4ed13023baec4d33ee6f4310b253
-
Filesize
80KB
MD5c91eb494ecd11c45830e334705d45392
SHA1ecefbf2f66bddac2efdd7596e522fd8aff959703
SHA2566fbbe2bc70692590a2cac95123e2f1cd003f5282bf504c2e2521e83c169608a4
SHA512dc76b509d9d047da066e286a60bf0c89717ecce0e060a261af5736e01471848b809c8368d16e8e96fa6780eb5c3dd974b5feae93dc94663f480093787f805954
-
Filesize
80KB
MD56f18f0551971e0b6a13781d60b37ff50
SHA158166d63c13a6bae87ef2f428662b0b03189390b
SHA256153c55e204a1e4858d354c04119027076ad3b25dad7115b4af6058ea6a291623
SHA512d66420239174396b184e0f40d27c925754372f30c4dda01a7bd7d64d29fbf6eb44278f1f3694273f75086c849075dcc9a6262386143819b3d4666d947d682f56
-
Filesize
80KB
MD5a3ff436888f29d09c797c7378fccf0a2
SHA14553e5e2589919f24bf2435469a03cd67e2c94b7
SHA2560e4a2365147a16df21c39de0817d4c319b123ccd75c443f73ae057e34d676150
SHA512154d01f388794f44ad4f653f998a5bb316b43950e775aabb83c319ba092e03f9ac3e225efc89d80d95c10cfdae6d0ee53944929e7ac9c430342d9f13220ac70e
-
Filesize
80KB
MD5897ff6288764aa2a7c2513e1c34269e0
SHA1e4797472397a128f72a396746cf653ecb2d54760
SHA256e4a9dd3f4d62d0c56e764c912d8f2e11a3c923f43ae89eef91c45102c010d415
SHA512c6e1d5679559f844b79dec585af76d67cba45a614bec6602933b502554c0a82aed82571cee98d08e85bd34e622278d056577c36a3e3355a5bc1455fb483d5ebc
-
Filesize
80KB
MD5a0eb0c9af17b37f532e7870d11a14e94
SHA10b3c4a48e0347f8d4a2f323bf38d50ec0a431dbf
SHA2569f49e68b8465d08709abd7880b00127761435cbff674149d24c57e832523764a
SHA512a9eaf4bd71b8a18d62cff032b53594b4c4b4949d2111c561f1706397a3d40c2ef631ada0c62b83177fc8e408efb9afb1681a77b7dfcd846a99ba795b8166b78c
-
Filesize
80KB
MD5f3e98eb3368828ca330e823f5e4a2a07
SHA1a2cdd2b0c86e7eb05edcfe08234199bf42e21b66
SHA25608b0e17fcf19c4c7848b662117acdb2634af8fbf2aba4bbdb1eb801374de6875
SHA5125149e8be226344e32b234d8b4158cfda347ddcd026e65d707c8cc1443dfdf3b7e27def2f556e53ac7b8dc378ddd07f2c600a3c235bf3c30bff95636e81b2478f
-
Filesize
80KB
MD50ebe9baf44591412504aaf1a1417360b
SHA14061aad2f8b108bb854a94f1ccf87ca4542a0b3a
SHA256bdb949442d250f4ed65d77932574ebef3fb08c3df7c01380c05e3dd0315427b2
SHA51210f1b57f0afad897dc1194be26bafe84d31023dd895cb10832a0c8ce497884f6602ae7e63eaf57ce3b0cc7e3d60726a315daea26cfede23a97d19e07c8fe9c11