Analysis
- max time kernel
122s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a8fa5e8e0eb0ad7e0cac93d9cb974d0_NeikiAnalytics.dll
Resource
win7-20240419-en
windows7-x64
15 signatures
150 seconds
General
- Target 0a8fa5e8e0eb0ad7e0cac93d9cb974d0_NeikiAnalytics.dll
- Size 120KB
- Sample240611-2vgnmsvflj
- SHA256 8a502125238d7f5bc13932a0b4aab6207313a53e60db95007ee5a813ec79edc1
- MD5 0a8fa5e8e0eb0ad7e0cac93d9cb974d0
- SHA1 a12357a037dc1067632ba21807664a10c7e029be
- SHA512 068c52e00ce5355373cdcfa24c46a57a9e1c420d8e3af79ea2f9333f1deaee1725da74dde6ae4138cbdddf8aed918916be113bb183eaad8ea02a119da5293294
- SSDEEP 1536:GGI1yLCNyR092B09n/C7L12/6gfNUcPyP4zq6Er9PwO1Z9ZVvoXfMl5H:FJR0N9Sa6iNU4IoIrtj1Zpk6B
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57609e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57609e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57609e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5737e8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5737e8.exe - Executes dropped EXE 3 IoCs
pid Process 632 e5737e8.exe 4396 e573930.exe 3268 e57609e.exe -
resource yara_rule behavioral2/memory/632-6-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-24-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-25-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-13-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-14-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-26-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-42-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-43-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-61-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-62-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-63-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-65-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-67-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-70-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-71-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-77-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-78-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-80-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-84-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/632-86-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/3268-120-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/3268-157-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5737e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5737e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5737e8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57609e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5737e8.exe - Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e5737e8.exe File opened (read-only) \??\I: e5737e8.exe File opened (read-only) \??\P: e5737e8.exe File opened (read-only) \??\H: e57609e.exe File opened (read-only) \??\I: e57609e.exe File opened (read-only) \??\G: e5737e8.exe File opened (read-only) \??\L: e5737e8.exe File opened (read-only) \??\O: e5737e8.exe File opened (read-only) \??\G: e57609e.exe File opened (read-only) \??\J: e5737e8.exe File opened (read-only) \??\Q: e5737e8.exe File opened (read-only) \??\J: e57609e.exe File opened (read-only) \??\H: e5737e8.exe File opened (read-only) \??\K: e5737e8.exe File opened (read-only) \??\M: e5737e8.exe File opened (read-only) \??\N: e5737e8.exe File opened (read-only) \??\E: e57609e.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5737e8.exe File opened for modification C:\Program Files\7-Zip\7z.exe e5737e8.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e5737e8.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5737e8.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e573827 e5737e8.exe File opened for modification C:\Windows\SYSTEM.INI e5737e8.exe File created C:\Windows\e57882b e57609e.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 632 e5737e8.exe 632 e5737e8.exe 632 e5737e8.exe 632 e5737e8.exe 3268 e57609e.exe 3268 e57609e.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe Token: SeDebugPrivilege 632 e5737e8.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 4976 2344 rundll32.exe 80 PID 2344 wrote to memory of 4976 2344 rundll32.exe 80 PID 2344 wrote to memory of 4976 2344 rundll32.exe 80 PID 4976 wrote to memory of 632 4976 rundll32.exe 81 PID 4976 wrote to memory of 632 4976 rundll32.exe 81 PID 4976 wrote to memory of 632 4976 rundll32.exe 81 PID 632 wrote to memory of 804 632 e5737e8.exe 8 PID 632 wrote to memory of 812 632 e5737e8.exe 9 PID 632 wrote to memory of 396 632 e5737e8.exe 13 PID 632 wrote to memory of 2684 632 e5737e8.exe 44 PID 632 wrote to memory of 2712 632 e5737e8.exe 45 PID 632 wrote to memory of 2844 632 e5737e8.exe 47 PID 632 wrote to memory of 3572 632 e5737e8.exe 56 PID 632 wrote to memory of 3724 632 e5737e8.exe 57 PID 632 wrote to memory of 3904 632 e5737e8.exe 58 PID 632 wrote to memory of 4004 632 e5737e8.exe 59 PID 632 wrote to memory of 4068 632 e5737e8.exe 60 PID 632 wrote to memory of 676 632 e5737e8.exe 61 PID 632 wrote to memory of 4232 632 e5737e8.exe 62 PID 632 wrote to memory of 1492 632 e5737e8.exe 73 PID 632 wrote to memory of 3788 632 e5737e8.exe 74 PID 632 wrote to memory of 2920 632 e5737e8.exe 76 PID 632 wrote to memory of 4988 632 e5737e8.exe 77 PID 632 wrote to memory of 968 632 e5737e8.exe 78 PID 632 wrote to memory of 2344 632 e5737e8.exe 79 PID 632 wrote to memory of 4976 632 e5737e8.exe 80 PID 632 wrote to memory of 4976 632 e5737e8.exe 80 PID 4976 wrote to memory of 4396 4976 rundll32.exe 82 PID 4976 wrote to memory of 4396 4976 rundll32.exe 82 PID 4976 wrote to memory of 4396 4976 rundll32.exe 82 PID 4976 wrote to memory of 3268 4976 rundll32.exe 86 PID 4976 wrote to memory of 3268 4976 rundll32.exe 86 PID 4976 wrote to memory of 3268 4976 rundll32.exe 86 PID 632 wrote to memory of 804 632 e5737e8.exe 8 PID 632 wrote to memory of 812 632 e5737e8.exe 9 PID 632 wrote to memory of 396 632 e5737e8.exe 13 PID 632 wrote to memory of 2684 632 e5737e8.exe 44 PID 632 wrote to memory of 2712 632 e5737e8.exe 45 PID 632 wrote to memory of 2844 632 e5737e8.exe 47 PID 632 wrote to memory of 3572 632 e5737e8.exe 56 PID 632 wrote to memory of 3724 632 e5737e8.exe 57 PID 632 wrote to memory of 3904 632 e5737e8.exe 58 PID 632 wrote to memory of 4004 632 e5737e8.exe 59 PID 632 wrote to memory of 4068 632 e5737e8.exe 60 PID 632 wrote to memory of 676 632 e5737e8.exe 61 PID 632 wrote to memory of 4232 632 e5737e8.exe 62 PID 632 wrote to memory of 1492 632 e5737e8.exe 73 PID 632 wrote to memory of 3788 632 e5737e8.exe 74 PID 632 wrote to memory of 2920 632 e5737e8.exe 76 PID 632 wrote to memory of 4396 632 e5737e8.exe 82 PID 632 wrote to memory of 4396 632 e5737e8.exe 82 PID 632 wrote to memory of 2248 632 e5737e8.exe 83 PID 632 wrote to memory of 696 632 e5737e8.exe 84 PID 632 wrote to memory of 3268 632 e5737e8.exe 86 PID 632 wrote to memory of 3268 632 e5737e8.exe 86 PID 3268 wrote to memory of 804 3268 e57609e.exe 8 PID 3268 wrote to memory of 812 3268 e57609e.exe 9 PID 3268 wrote to memory of 396 3268 e57609e.exe 13 PID 3268 wrote to memory of 2684 3268 e57609e.exe 44 PID 3268 wrote to memory of 2712 3268 e57609e.exe 45 PID 3268 wrote to memory of 2844 3268 e57609e.exe 47 PID 3268 wrote to memory of 3572 3268 e57609e.exe 56 PID 3268 wrote to memory of 3724 3268 e57609e.exe 57 PID 3268 wrote to memory of 3904 3268 e57609e.exe 58 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5737e8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57609e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:396
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2712
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2844
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3572
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8fa5e8e0eb0ad7e0cac93d9cb974d0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a8fa5e8e0eb0ad7e0cac93d9cb974d0_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\e5737e8.exeC:\Users\Admin\AppData\Local\Temp\e5737e8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\e573930.exeC:\Users\Admin\AppData\Local\Temp\e573930.exe4⤵
- Executes dropped EXE
PID:4396
-
-
C:\Users\Admin\AppData\Local\Temp\e57609e.exeC:\Users\Admin\AppData\Local\Temp\e57609e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3268
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3724
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4068
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:676
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4232
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1492
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3788
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2920
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4988
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:968
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2248
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:696
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5737e8.exe
- Size 97KB
- SHA256 ce7ce0912f3b0c5a579e3352fbccc8ac0e1f3a564ffd9ce8ce851abc8093c861
- MD5 d96afdff464bda57fa5ac1a3b2b0c52f
- SHA1 023e5e7fb1c33636f2862346b3a2bde42879778b
- SHA512 75f12ea0598bf4043e20aacc38b1cf4218e68e0211541a504d1029c09c6e546cf6f4bf14bdf30c1ec759b40d836127274056ac0af7df3f2e2f3f662d8c67df0e
- SSDEEP 3072:1O17GX4lpQkDkcZWJxfWpacKgR3cRYN/:1OpGXypQe3ZOWUcKgRqYN/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 12c2431221be006f8c5f0b09443647a87f242cbb783bb39c789372bcb21b2275
- MD5 a760a648911800e9154bae93cb468f17
- SHA1 d96e1a2ee872a7c5db4130286e3faf6b46da4af3
- SHA512 5f1c2ae7478096cd53946e2be975c1306200ea6b30d5110267a127d3ec7656349b465562caab4d967bb32d743f8962a4d5115c995ac5d008740ebdece678d6bb
- MD5 SHA1 SHA512