Analysis
-
max time kernel
93s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 16:22
Behavioral task
behavioral1
Sample
6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe
-
Size
232KB
-
MD5
6bea8ef3668d7c8dbffc79735771d080
-
SHA1
549e0647687d06f98b48d81109444492dc43dcd9
-
SHA256
36af0f14f529603d7046850eff639ec28b64fda03f286c91c87e7cd2a6aefe46
-
SHA512
7e75df5fc16f03187b46bb172c2e5856de7df07471938e974d92042516b551c83176fbfbaae795c3badcb41782c5cdb7b6ee4d96dea89124528d8e561e38641e
-
SSDEEP
3072:51i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:7i/NjO5xbg/CSUFLTwMjs6oi/N+O7
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/4924-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023420-16.dat upx behavioral2/files/0x0009000000023419-11.dat upx behavioral2/memory/4924-169-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\ie.bat 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\qx.bat 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\windows.exe 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe File opened for modification C:\WINDOWS\windows.exe 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe File opened for modification C:\WINDOWS\windows.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4C5872C9-24EA-11EF-A084-DAD58692AE8D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31111415" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31111415" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "550209992" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c83740000000002000000000010660000000100002000000045ae9909f6a3bbec4f768bec2a8680b0fe2f37365e1b4afa7fa324fe84688f21000000000e8000000002000020000000de6666c1a9f89d2cb9f3d5490244d14892e40a791ffd91359fdfa8d22e0b40312000000042e3742c4a82796868ca47d48289afccde3f14ce687c5ed989e4726c55b84211400000003ea8c1237aa2040ed34884a992347811556d97b5eca7fc87f0ceca01ead423a0b01401c343b58279059cf0643bb146941b49312c570587ac462eeaea9714eedc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31111415" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424542393" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ebff38f7b8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "548803243" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a1fd38f7b8da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "548803243" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c837400000000020000000000106600000001000020000000abc0553c6c63041ab8c30b4e1dbea29c97bfe8679cbcff4e1268623d021f92d5000000000e8000000002000020000000e530a6304eb3b12816f8ba968941ed30201d2c6c942ca10670678ed61488218920000000155756a6c2f15ed014f557528532059f6e3254be00567799f594a30338de8a7c400000004abc246dbc8bfa84e69a3fd2b5bde5551a0f58c23e061734d0492f58a5ec4dfa3151dc70e74e0c42c22b8d505f5cc6bec598f869eb109e700b198b1aa94c3e8e iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2600 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 2600 iexplore.exe 2600 iexplore.exe 4904 IEXPLORE.EXE 4904 IEXPLORE.EXE 4904 IEXPLORE.EXE 4904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4924 wrote to memory of 2600 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 82 PID 4924 wrote to memory of 2600 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 82 PID 2600 wrote to memory of 4904 2600 iexplore.exe 84 PID 2600 wrote to memory of 4904 2600 iexplore.exe 84 PID 2600 wrote to memory of 4904 2600 iexplore.exe 84 PID 4924 wrote to memory of 2972 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 85 PID 4924 wrote to memory of 2972 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 85 PID 4924 wrote to memory of 2972 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 85 PID 2972 wrote to memory of 4868 2972 cmd.exe 87 PID 2972 wrote to memory of 4868 2972 cmd.exe 87 PID 2972 wrote to memory of 4868 2972 cmd.exe 87 PID 4924 wrote to memory of 3320 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 88 PID 4924 wrote to memory of 3320 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 88 PID 4924 wrote to memory of 3320 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 88 PID 3320 wrote to memory of 4048 3320 cmd.exe 90 PID 3320 wrote to memory of 4048 3320 cmd.exe 90 PID 3320 wrote to memory of 4048 3320 cmd.exe 90 PID 4924 wrote to memory of 4920 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 91 PID 4924 wrote to memory of 4920 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 91 PID 4924 wrote to memory of 4920 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 91 PID 4920 wrote to memory of 2932 4920 cmd.exe 93 PID 4920 wrote to memory of 2932 4920 cmd.exe 93 PID 4920 wrote to memory of 2932 4920 cmd.exe 93 PID 4924 wrote to memory of 2296 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 94 PID 4924 wrote to memory of 2296 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 94 PID 4924 wrote to memory of 2296 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 94 PID 2296 wrote to memory of 4056 2296 cmd.exe 96 PID 2296 wrote to memory of 4056 2296 cmd.exe 96 PID 2296 wrote to memory of 4056 2296 cmd.exe 96 PID 4924 wrote to memory of 1988 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 97 PID 4924 wrote to memory of 1988 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 97 PID 4924 wrote to memory of 1988 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 97 PID 1988 wrote to memory of 1064 1988 cmd.exe 100 PID 1988 wrote to memory of 1064 1988 cmd.exe 100 PID 1988 wrote to memory of 1064 1988 cmd.exe 100 PID 4924 wrote to memory of 2208 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 101 PID 4924 wrote to memory of 2208 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 101 PID 4924 wrote to memory of 2208 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 101 PID 2208 wrote to memory of 1504 2208 cmd.exe 103 PID 2208 wrote to memory of 1504 2208 cmd.exe 103 PID 2208 wrote to memory of 1504 2208 cmd.exe 103 PID 4924 wrote to memory of 1380 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 113 PID 4924 wrote to memory of 1380 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 113 PID 4924 wrote to memory of 1380 4924 6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe 113 PID 1380 wrote to memory of 2736 1380 cmd.exe 106 PID 1380 wrote to memory of 2736 1380 cmd.exe 106 PID 1380 wrote to memory of 2736 1380 cmd.exe 106 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 2736 attrib.exe 1504 attrib.exe 4868 attrib.exe 4048 attrib.exe 2932 attrib.exe 4056 attrib.exe 1064 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6bea8ef3668d7c8dbffc79735771d080_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4904
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:4868
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:4048
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- Views/modifies file attributes
PID:2932
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:4056
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:1064
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1504
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- Views/modifies file attributes
PID:2736
-
-
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:1380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5b342fb24d6c7d9215731a17e94743502
SHA10e6ef1eca8b3c7bda6da7f1f792919a5fdc71a34
SHA2567be1369161dae7ccbe4b699b2682bdd28141761e6afed9451ffa8626bf812cd1
SHA512963af63ab70072c83ca49a658735b7d6b76d09081e8b97eb1a23b2e5ef131a83a4ab5903edcc53596f216ee1eb6b2c68e48f2a102e2b6eca672a99b71b51eb40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5f517ee4a7b0317abcf4d618b44c17683
SHA102caa5a48378931e898c347b808ef38a00a3c3d9
SHA2565867c256a76c099b3092a47b0e8d5f56667545ba8c4a15675bbb95cbcdedd4ff
SHA512766f62fc93dbced430d0837f2d12eeb1b811d77c5ec6824f2bb377d8f069913f15c235b0ae35a770e460e9a87596f3c38aa1f1cb67b3d526e3f4838b6301edc4
-
Filesize
776B
MD50542ad8156f4dfca7ddcfcb62a6cb452
SHA1485282ba12fc0daf6f6aed96f1ababb8f91a6324
SHA256c90cdefdb6d7ad5a9a132e0d3b74ecdb5b0d5b442da482129ba67925a2f47e8f
SHA5120b41affa129277bf4b17d3e103dc4c241bc2ac338858cc17c22e172ec2ac65539b63e802246efb462cd134d99907d9c5ed9bc03937cadcca3155b703ac6e3195
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
33KB
MD524bb520e9517f2ed3ed987b46aeaf723
SHA1846723563d7dd2bff3954f93633b11af0103adc8
SHA256d1f1bfe698f2ffb7b3e7a885a301d58f9554d45df0a31c3e8b53c84b33c80d27
SHA51231afbcd2ee87c84cc3e56355da8ddc741a69d918c2687984265745d8046deb18c494cbca6aaf8d4eae6b035e888e6f7cf9b0d59a255f2714963d7b3edbb3c87f
-
Filesize
232KB
MD535e5ca3f533198464154c48a4c23afc7
SHA16f54418e1964881c72b5a759370bbd62fc23e698
SHA256f12888b3e1db565eac882abcf67ac2ecc3cacb6c8443b1654428b813807ee183
SHA512a8c38fc989f0e6cdcfb1dbcf3f38c509df74da27d56ab7c13e179e880624017b844abb499a9a6a4f89a57b2aea878e39ad5160d57754dbd2e6f472cc2c49f340
-
Filesize
232KB
MD5ecfed6d12a63ba09bbc71c3d2fe56ef0
SHA1e3bef29ffe53aa4c1006a87ffe7d8fcea42061bd
SHA2563d83f57a12772488bb24fca5c4cbbba0b9652b2932877aa5ccac72fd9f7c6928
SHA512648f93392e66dcbb6c20f462434c75a2471021811d91569ca7e9abb2e6b32593d918e5f151e681a12fe62db3cda76c6442e5e9ee63e0c88217eaf80c0113452f