Malware Analysis Report

2025-01-18 14:44

Sample ID 240613-d4h13asgnd
Target 5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe
SHA256 f802e170bbd09e7ee23fd8c4fff6ca8827d509f23bd26bc9c90aa3489dbd8fb2
Tags
evasion persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f802e170bbd09e7ee23fd8c4fff6ca8827d509f23bd26bc9c90aa3489dbd8fb2

Threat Level: Known bad

The file 5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence upx

Modifies firewall policy service

Checks computer location settings

UPX packed file

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 03:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 03:33

Reported

2024-06-13 03:36

Platform

win7-20240508-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IDungProV5.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IDungProV5.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2104 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1816 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1816 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1816 wrote to memory of 2728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2104 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2104 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2104 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2104 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2648 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2608 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2536 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2536 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2536 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 1796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2528 wrote to memory of 1064 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2572 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2572 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2572 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2572 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\vMwkK.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

"C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe"

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp

Files

memory/2104-0-0x0000000000400000-0x00000000005F7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vMwkK.bat

MD5 12506b1a3ef0e7dcef2babaaecfb81e8
SHA1 9564f2c31b336dab739e74cceedb5e4d07c2a563
SHA256 3922b88903f6e7a4cd1e9cee92f9a0de6f0cd28a4a6db73114e320fa7cbf8c8a
SHA512 cbf0ade56c9961edcf8018f8e1654446e17c863e8df98a78b781b4b91ca87a9ab3b1532376f245c678f6f9e00771d74dba99e0fee237ebf3f4a69473d57f0dec

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

MD5 43eb5fe5d5c956c7e2e54d71266be4d6
SHA1 b4607b8465d89219ef84f42bca0c2b8f7320f597
SHA256 8c8f6da18111472c3be9f69763fe11e2e2b5a4b060b8450105d6eb0fa94d7b92
SHA512 4f836a2ae2297cc2f057fcecda35e843a250029e305be52d0adb9e5dab9f17811eb55f07623fcaa475eb8999fa1a56a9af08bf155487bcb97d1c2cbfb00514f7

memory/2608-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-48-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1668-57-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1668-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1668-62-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2608-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1668-68-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2608-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-73-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-80-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-82-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-87-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-89-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-91-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-94-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-96-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2608-98-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 03:33

Reported

2024-06-13 03:36

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IDungProV5.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IDungProV5.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 920 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 920 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 920 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Windows\SysWOW64\cmd.exe
PID 3388 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 1900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 920 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 920 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 920 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1140 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4064 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4064 wrote to memory of 536 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 4140 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4140 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4140 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4996 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4996 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4996 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 536 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 536 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 536 wrote to memory of 1904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5b1dbf1ff196fc15c3f7117dc066e750_NeikiAnalytics.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XVBAx.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

"C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe"

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp

Files

memory/920-0-0x0000000000400000-0x00000000005F7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XVBAx.txt

MD5 12506b1a3ef0e7dcef2babaaecfb81e8
SHA1 9564f2c31b336dab739e74cceedb5e4d07c2a563
SHA256 3922b88903f6e7a4cd1e9cee92f9a0de6f0cd28a4a6db73114e320fa7cbf8c8a
SHA512 cbf0ade56c9961edcf8018f8e1654446e17c863e8df98a78b781b4b91ca87a9ab3b1532376f245c678f6f9e00771d74dba99e0fee237ebf3f4a69473d57f0dec

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.txt

MD5 1e8d416984f1f76d3d451f376f54703d
SHA1 fda612872fba58638858d95a55aa846c47578d02
SHA256 4ebebdf60aa8502100cffb2d86bc6123182f958f56e8c75e54f399a69987724b
SHA512 dad1ab8fe8056b75367959a36866dac789056b77b8bfe7f8420870df1d817a73f583745348dce34f0196e217bce49a6fe840394faed8bb9afb99867dcf73d794

memory/4064-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4260-37-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4260-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4260-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4064-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4260-51-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4064-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-63-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4064-74-0x0000000000400000-0x000000000045C000-memory.dmp