Analysis
- max time kernel
127s - max time network
121s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
12/06/2024, 01:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
16 signatures
150 seconds
General
- Target 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe
- Size 65KB
- Sample240612-b2cedsxhnd
- SHA256 65df58202fd349d21c17810d012f4c69aac15779bffb2119b17ec7121abbecb7
- MD5 156a6c0bffae044a4193450eb0b9dad0
- SHA1 4ec882221f3174e80aebcea195629ac8e519dacf
- SHA512 eb8d01b5c085a4c2ae8acbca2fcf9be62e417d8bcab27e4118a6d40d952e9d88a28e93ddc63d091304134d19756b20f0f3573b2d00dccdfc60a956a8d4a49494
- SSDEEP 1536:gXSj+OFVZsf8hzRpYvd4P5F6Hmbwqslu0wM35gp:gARFVGf8hzRuvdi5ImcUP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/1976-1-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-4-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-9-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-3-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-7-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-10-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-8-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-6-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-11-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-5-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-28-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-29-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-30-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-31-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-32-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-34-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-35-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-36-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-37-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-40-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-45-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-47-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-50-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-51-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-56-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-57-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-60-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-61-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-62-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-65-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1976-71-0x0000000000710000-0x00000000017CA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\L: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\R: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\U: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\V: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\W: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\E: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\I: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\K: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\Q: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\T: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\J: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\M: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\N: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\O: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\P: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\X: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\G: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\S: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\Y: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened (read-only) \??\Z: 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened for modification F:\autorun.inf 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76004f 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe Token: SeDebugPrivilege 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 2352 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 23 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 PID 1976 wrote to memory of 1084 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 18 PID 1976 wrote to memory of 1136 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 19 PID 1976 wrote to memory of 1200 1976 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe 21 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1084
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1136
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\156a6c0bffae044a4193450eb0b9dad0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1976
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2352
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path F:\cpgfl.exe
- Size 97KB
- SHA256 ae023daef1dfa95c19e54026c8fb6b364b85906a6c9892c3a8554117419bb663
- MD5 4f0c1a5bc9c8865e6da99dcd69ae06e3
- SHA1 9968d94c7ad3bfd3661cf71b3df22ab671217101
- SHA512 d1f3bf102187aa2824c8b0d42d5eea73b827f413c53ba50efcd47f9eefca1b5bae9d316f16f544636b53f3eb7828554d823c357187138797731d135d06cf23ff
- SSDEEP 1536:IPQtG3SgwjwYndtScXPFlcXemFiWwV/uof+CfLAUZua0ih1klCJGi/:IPQtGCgCwGlXPFZfKC8UZx3h1ZGM
- MD5 SHA1 SHA512 SSDEEP