Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 10:04
Behavioral task
behavioral1
Sample
4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe
- Size 232KB
- Sample240607-l4acxsef2x
- SHA256 669377ee5b9052845d46e9d71a5995cbe316d0c2772bdac135faa6a8bd3d2559
- MD5 4c77a4e6b8d3319b4aee2c8d148581c0
- SHA1 c43fae01138ecd0bfc72538a0e7563909b6d312f
- SHA512 8afff9dd4c4fc3e6a63db7d82df6213536c3a63c70df1a34613c7d81512b96e8996be7a0e87ae0b5877b7618abb91350f0d8653e03a485d1b341f641cf1dbc79
- SSDEEP 3072:m1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ai/NjO5xbg/CSUFLTwMjs6oi/N+O7
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/3320-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0008000000023437-17.dat upx behavioral2/files/0x000700000002343b-18.dat upx behavioral2/memory/3320-174-0x0000000000400000-0x000000000043A000-memory.dmp upx - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\qx.bat 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\ie.bat 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\windows.exe 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\windows.exe 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\windows.exe attrib.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424519656" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "812240783" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5C09CBA7-24B5-11EF-BCA5-4A7C5F4B2F01} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "812240783" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31111362" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8047e447c2b8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31111362" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007bd2b5d2c6d91e4f8f2c8e8b7d41a41500000000020000000000106600000001000020000000c85e6eb9e8a7d0e7679cc4ac8e7a9113ecbdd56a336f0effcc956014acc5d372000000000e80000000020000200000008ba599d7443ca3f1b22efcd4ef9e98eaac494cc6119ef388c5f59d9477bce74c20000000dd4d7ca9e71e48e65a1425c948db485bc62533403ac4756f482ba5ed9e70fba940000000b7d4a3bf227e63874556643b1258381a1482a22ded757ab977a77aac171df4e974270c3e65c1db3b763ddf2ee24f13ef3bd359e391ce4ced753249bcc5de2fa4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31111362" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007bd2b5d2c6d91e4f8f2c8e8b7d41a4150000000002000000000010660000000100002000000010e2d96cbe2b306d27331bde3f8bcdd83bee5cd6aaee795a909ad7fee575a68d000000000e800000000200002000000017f67ace35fc7f2c57d0701de9bb11a8cff0284eb4982b4e9fae4e177af8c50a20000000c46fcf63c39a26778a6b8191ce5088616b030645c5f696b7490860d675560c8b4000000053b562f4b886da2e713f77e37d991a11c2fb408302f1deee2101b8bdcc1eecbb1903e42cc2c9fe4617c8ed30c67a3f8e61b9f4ea313ee46407db2a37fb34c0d5 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "815052896" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7002e947c2b8da01 iexplore.exe - Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 iexplore.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 1752 iexplore.exe 1752 iexplore.exe 4284 IEXPLORE.EXE 4284 IEXPLORE.EXE 4284 IEXPLORE.EXE 4284 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3320 wrote to memory of 1752 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 83 PID 3320 wrote to memory of 1752 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 83 PID 1752 wrote to memory of 4284 1752 iexplore.exe 84 PID 1752 wrote to memory of 4284 1752 iexplore.exe 84 PID 1752 wrote to memory of 4284 1752 iexplore.exe 84 PID 3320 wrote to memory of 3752 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 85 PID 3320 wrote to memory of 3752 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 85 PID 3320 wrote to memory of 3752 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 85 PID 3752 wrote to memory of 1644 3752 cmd.exe 87 PID 3752 wrote to memory of 1644 3752 cmd.exe 87 PID 3752 wrote to memory of 1644 3752 cmd.exe 87 PID 3320 wrote to memory of 3652 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 88 PID 3320 wrote to memory of 3652 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 88 PID 3320 wrote to memory of 3652 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 88 PID 3652 wrote to memory of 1864 3652 cmd.exe 90 PID 3652 wrote to memory of 1864 3652 cmd.exe 90 PID 3652 wrote to memory of 1864 3652 cmd.exe 90 PID 3320 wrote to memory of 916 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 91 PID 3320 wrote to memory of 916 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 91 PID 3320 wrote to memory of 916 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 91 PID 916 wrote to memory of 3856 916 cmd.exe 93 PID 916 wrote to memory of 3856 916 cmd.exe 93 PID 916 wrote to memory of 3856 916 cmd.exe 93 PID 3320 wrote to memory of 2460 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 94 PID 3320 wrote to memory of 2460 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 94 PID 3320 wrote to memory of 2460 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 94 PID 2460 wrote to memory of 2364 2460 cmd.exe 96 PID 2460 wrote to memory of 2364 2460 cmd.exe 96 PID 2460 wrote to memory of 2364 2460 cmd.exe 96 PID 3320 wrote to memory of 1716 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 97 PID 3320 wrote to memory of 1716 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 97 PID 3320 wrote to memory of 1716 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 97 PID 1716 wrote to memory of 532 1716 cmd.exe 99 PID 1716 wrote to memory of 532 1716 cmd.exe 99 PID 1716 wrote to memory of 532 1716 cmd.exe 99 PID 3320 wrote to memory of 4432 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 100 PID 3320 wrote to memory of 4432 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 100 PID 3320 wrote to memory of 4432 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 100 PID 4432 wrote to memory of 1980 4432 cmd.exe 102 PID 4432 wrote to memory of 1980 4432 cmd.exe 102 PID 4432 wrote to memory of 1980 4432 cmd.exe 102 PID 3320 wrote to memory of 1912 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 103 PID 3320 wrote to memory of 1912 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 103 PID 3320 wrote to memory of 1912 3320 4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe 103 PID 1912 wrote to memory of 632 1912 cmd.exe 105 PID 1912 wrote to memory of 632 1912 cmd.exe 105 PID 1912 wrote to memory of 632 1912 cmd.exe 105 - Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 1644 attrib.exe 1864 attrib.exe 3856 attrib.exe 2364 attrib.exe 532 attrib.exe 1980 attrib.exe 632 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c77a4e6b8d3319b4aee2c8d148581c0_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4284
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:1644
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:1864
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- Views/modifies file attributes
PID:3856
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:2364
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:532
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1980
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- Views/modifies file attributes
PID:632
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 7be1369161dae7ccbe4b699b2682bdd28141761e6afed9451ffa8626bf812cd1
- MD5 b342fb24d6c7d9215731a17e94743502
- SHA1 0e6ef1eca8b3c7bda6da7f1f792919a5fdc71a34
- SHA512 963af63ab70072c83ca49a658735b7d6b76d09081e8b97eb1a23b2e5ef131a83a4ab5903edcc53596f216ee1eb6b2c68e48f2a102e2b6eca672a99b71b51eb40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A4B782275DC1682E4DC39E697A49B151
- Size 1KB
- SHA256 973a41276ffd01e027a2aad49e34c37846d3e976ff6a620b6712e33832041aa6
- MD5 96c25031bc0dc35cfba723731e1b4140
- SHA1 27ac9369faf25207bb2627cefaccbe4ef9c319b8
- SHA512 42c5b22334cd08c727fdec4aca8df6ec645afa8dd7fc278d26a2c800c81d7cff86fc107e6d7f28f1a8e4faf0216fd4d2a9af22d69714ca9099e457d1b2d5188a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 1ff8c63059b63332e17f7b0adb835e7e33f1f8af74b92c8462e41882dacbe738
- MD5 87917a23f761c6dffcdd53cb1c2a776d
- SHA1 1c5ea9c0e82263c50bb0dc2a6069977effa72f0e
- SHA512 b562d066431ffb5d25d17c9ea962cd55d9ad22e8b1b90dc75859e49055f58d28f7ab023e3daf8d8ac00875317615a5d99ed9a30900187a57c901c0d9bb5a4060
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4B782275DC1682E4DC39E697A49B151
- Size 262B
- SHA256 595fe58ddb73f7e5491f9dc28af9fcfe54a8a53be7b192e365115d77c9400a78
- MD5 1889378a898ddb887b58b446e06ed62a
- SHA1 c3006ceb666b501c9699a12064881547ef1f6325
- SHA512 d88a13395475ba85c1e5e41332b94c1790488c916b4c913840e835552d1c12cdd14879f34d7c0ade8f60ced242505c1b199392eb203e8e287a3029b001da999b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMPDKH9Q\favicon[1].htm
- Size 776B
- SHA256 c90cdefdb6d7ad5a9a132e0d3b74ecdb5b0d5b442da482129ba67925a2f47e8f
- MD5 0542ad8156f4dfca7ddcfcb62a6cb452
- SHA1 485282ba12fc0daf6f6aed96f1ababb8f91a6324
- SHA512 0b41affa129277bf4b17d3e103dc4c241bc2ac338858cc17c22e172ec2ac65539b63e802246efb462cd134d99907d9c5ed9bc03937cadcca3155b703ac6e3195
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMPDKH9Q\js-sdk-pro.min[1].js
- Size 33KB
- SHA256 d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27
- MD5 24bb520e9517f2ed3ed987b46aeaf723
- SHA1 846723563d7dd2bff3954f93633b11af0103adc8
- SHA512 31afbcd2ee87c84cc3e56355da8ddc741a69d918c2687984265745d8046deb18c494cbca6aaf8d4eae6b035e888e6f7cf9b0d59a255f2714963d7b3edbb3c87f
- SSDEEP 768:XzD9qAO+a/y1jaKUiQU5enEU9GMXB0XXQVEXB3CNSPf:XzD9qnT/c+KUc5enEU9GMXB/EXB3LPf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMPDKH9Q\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\WINDOWS\windows.exe
- Size 232KB
- SHA256 4591bccafd5ac2dcd4df9f017d36708877cf2338cf9fc91845fa8e787aa0d05a
- MD5 9f34dbe801e638b5cad9b824e43b5d9a
- SHA1 e2e31d9b125e640cb8518f9a04ad626d3e33d1a0
- SHA512 67e7400a1a07531a8505006c086ca132ca7aa7355f8dbd4e328c7b6ed2c589145a3bab4cdadb2d92711b449e8e000bcee21d2a43369d91e048cf07281b69fc5f
- SSDEEP 3072:k1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ci/NjO5xbg/CSUFLTwMjs6oi/N+O7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\system.exe
- Size 232KB
- SHA256 073baa08aeac3bb5d8c32d3cf1d1e16d002bb739fea0e67fa01230ff2d9d2b2e
- MD5 cd019ad358f098217f5a75e64fcd7173
- SHA1 f0c7cc996cf263397f3b98f71fb8b98eab70cd29
- SHA512 69f42905c274776a2560b3b0cf18042f6af98e215ba1d8eb32941ef4ef8b8cc2b0090902db251a06f61ad68092f087e251eba7b459363c21b0fe18b324d0ef7e
- SSDEEP 3072:t1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Pi/NjO5xbg/CSUFLTwMjs6oi/N+O7
- MD5 SHA1 SHA512 SSDEEP