a41e60d254cfe65b2c5e75c80effecb98fadd8a556cdbbe187243f865830a929

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
Size 124KB
Sample240613-bxk6qsshjq
SHA256 a41e60d254cfe65b2c5e75c80effecb98fadd8a556cdbbe187243f865830a929
MD5 53bceb0a0a5381700b038c3a00b6a3e0
SHA1 ce02ca5fc3bd9f88a0129ff75266b2907c830918
SHA512 7ecc3ea093c217db234d9f1c3c443207d849236bae9156d6dd7c7e677428eb1084f9301d82d21c1afb6a910f4d86491102888bb7d051c1fa640594d0aa98e0b9
SSDEEP 3072:k1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOts5YmMOMYcYY51i/NU8:Ci/NjO5YBgegD0PHzSW3Oai/N
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
File opened for modification	C:\WINDOWS\windows.exe	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c03c6d9d31bdda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2251810499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112497"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b804055d0b5d94598b8a342c378f0de00000000020000000000106600000001000020000000a035e9831651dcbaad3023f236dafb5584f078b774ffbaf8c536d7f97bfc84d0000000000e8000000002000020000000888589ebe3bc80e0bcdd24f93d31ab609602ab458b814b929c4676ab215b5dc5200000009ba282932b6ff9898e8b4de30f11586b7b88e9eb934e2c7ca29c4b107e50f0e240000000e2b864e81101029f67b36f5f44bb99d7ac8cd4e87f899e13be1c37fa14af726ab4c7cbfd16c56a2fe9ad5d71ad5e0bc482c8a5270c6f56688440cf47fdc4efa9	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425007285"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2251810499"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112497"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112497"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2302435951"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05af89c31bdda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b804055d0b5d94598b8a342c378f0de0000000002000000000010660000000100002000000054ce68b59683470bb7ff40d6f87eaf9af39dafa876036111b1138a9f2df86224000000000e80000000020000200000004ddb224e346ae2162e378b34000e078884cf8671e02a6a0a30a334936f42921b2000000016d05f7ce575d4e4b1eda2585e8078fe2c3c0cdf9252e3561c17f27ed396edf14000000027d4c8fc3cf3a0104a713572381331c1336efe7b8b6ecb37028fbbcc0454c6932e16a2aada4399e9238081b4d628c2a52fc1794b13c973f04f4017bd4e73806f	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B049BE73-2924-11EF-B9F7-5E2396FD2BC6} = "0"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2128	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	92
PID 3176 wrote to memory of 2128	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	92
PID 2128 wrote to memory of 2724	2128	IEXPLORE.EXE	93
PID 2128 wrote to memory of 2724	2128	IEXPLORE.EXE	93
PID 2128 wrote to memory of 2724	2128	IEXPLORE.EXE	93
PID 3176 wrote to memory of 2364	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	94
PID 3176 wrote to memory of 2364	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	94
PID 3176 wrote to memory of 744	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	95
PID 3176 wrote to memory of 744	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	95
PID 3176 wrote to memory of 744	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	95
PID 744 wrote to memory of 3476	744	cmd.exe	97
PID 744 wrote to memory of 3476	744	cmd.exe	97
PID 744 wrote to memory of 3476	744	cmd.exe	97
PID 3176 wrote to memory of 5064	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	98
PID 3176 wrote to memory of 5064	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	98
PID 3176 wrote to memory of 5064	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	98
PID 5064 wrote to memory of 2920	5064	cmd.exe	100
PID 5064 wrote to memory of 2920	5064	cmd.exe	100
PID 5064 wrote to memory of 2920	5064	cmd.exe	100
PID 3176 wrote to memory of 4340	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	101
PID 3176 wrote to memory of 4340	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	101
PID 3176 wrote to memory of 4340	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	101
PID 4340 wrote to memory of 712	4340	cmd.exe	103
PID 4340 wrote to memory of 712	4340	cmd.exe	103
PID 4340 wrote to memory of 712	4340	cmd.exe	103
PID 3176 wrote to memory of 4872	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	104
PID 3176 wrote to memory of 4872	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	104
PID 3176 wrote to memory of 4872	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	104
PID 4872 wrote to memory of 3604	4872	cmd.exe	106
PID 4872 wrote to memory of 3604	4872	cmd.exe	106
PID 4872 wrote to memory of 3604	4872	cmd.exe	106
PID 3176 wrote to memory of 1592	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	107
PID 3176 wrote to memory of 1592	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	107
PID 3176 wrote to memory of 1592	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	107
PID 1592 wrote to memory of 4208	1592	cmd.exe	109
PID 1592 wrote to memory of 4208	1592	cmd.exe	109
PID 1592 wrote to memory of 4208	1592	cmd.exe	109
PID 3176 wrote to memory of 4056	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	110
PID 3176 wrote to memory of 4056	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	110
PID 3176 wrote to memory of 4056	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	110
PID 4056 wrote to memory of 2604	4056	cmd.exe	112
PID 4056 wrote to memory of 2604	4056	cmd.exe	112
PID 4056 wrote to memory of 2604	4056	cmd.exe	112
PID 3176 wrote to memory of 2256	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	113
PID 3176 wrote to memory of 2256	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	113
PID 3176 wrote to memory of 2256	3176	53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe	113
PID 2256 wrote to memory of 3232	2256	cmd.exe	115
PID 2256 wrote to memory of 3232	2256	cmd.exe	115
PID 2256 wrote to memory of 3232	2256	cmd.exe	115

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3232	attrib.exe
3476	attrib.exe
2920	attrib.exe
712	attrib.exe
3604	attrib.exe
4208	attrib.exe
2604	attrib.exe

C:\Users\Admin\AppData\Local\Temp\53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\53bceb0a0a5381700b038c3a00b6a3e0_NeikiAnalytics.exe"
1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2724
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Views/modifies file attributes
    PID:712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - Views/modifies file attributes
    PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 162d6ec1c80bfa580264b7881b60119e3120dfc0c110ceee333cdd63cb99e3e0
MD5 45acb5c62071b7f7865c485f0d0aa31c
SHA1 d6e5854f77845407698df1a1aea949af83f2503c
SHA512 16a2388f04d0a81e64b606e50c06b31159156299388b11e548f4daa700df1e9ab8e5c6db629fb09ed7c0f78941e73bb63b3cc113ae1159a9b8880e22a1eea6e4
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 f1ec64890ddcc3b6ecbdab6ced7b400bfbf815f4179748db93b666adb0a260c0
MD5 efaa4ff4d1120cd78145fb3b0894636d
SHA1 b994ab4b8e239c358afd3c61b582aa602d571371
SHA512 1e3bf5870cc1944e78ffc6274773e16b052a872bf8d3659fa5d171911f68b3f16fc437ec84e13daf1be7f0cf6beeff32a2d5d04e89beeac5d7328529580bb018
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows.exe

Path C:\WINDOWS\windows.exe
Size 124KB
SHA256 b76b46088fbdcd932a0d3fcfa6d64acfa9a5f971399afdd821de5805bce2b2fe
MD5 482b3f87bf23facdcd248edb3e97fbbb
SHA1 ad792e2d580134e201e24503555629017ad45de1
SHA512 a653cdf2e60bb45a0567ab48c8f3fb9b8f9d94aa18a3ea17eed1199b8d7ddfb962f33d382aed28b5d8f916a07a16953fca42f4118ca2535797f67708e8c7d50f
SSDEEP 3072:y1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOts5YmMOMYcYY51i/NU8:si/NjO5YBgegD0PHzSW3Oai/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\system.exe
Size 124KB
SHA256 06e102fae08127bc93d764be13e1b26bf50c5cfb9ea986d6b4fc7598c07d0cfe
MD5 aa50e19cc5cadd6017843e82b5976134
SHA1 258a65a3ba812b56ecee9aa159a3e888f7775714
SHA512 798f94c47cbf186599dcd7193fef65fbc91a0521466b316e9ed157580b0a4915282827c6eaf5ff613a3bee6405e91bfd842e6698e58bad4da175f90576c1fe36
SSDEEP 3072:j1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOts5YmMOMYcYY51i/NU8:xi/NjO5YBgegD0PHzSW3Oai/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3176-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download